If I follow the news releases correctly, this arrest is not of Shadowbrokers but instead the trail from Shadowbrokers led back to a server(s) w/the NSA toolkit installed. Perhaps NSA followed those breadcrumbs back to this individual. Or: Shadowbrokers discovered actual NSA server and NSA is trying to scapegoat an individual in order to shed the appearance of operational ineptitude.
Sure sounds like a plausible candidate considering what Shadow Brokers were touting.