I don't follow. Why would an EU country punish a US citizen for reporting espionage/sabotage directed against the EU country? Or do you mean something else?
They would need guaranteed non-extradition and possibly a lot of protection so they don't get abducted by the US, but that sort of legislation would never sail under the current German government.
Treason is a crime in Germany, too, and whether the result is politically opportune for Germany couldn't officially play a role in front of a Oberlandesgericht court when ruling on an extradition request by the US. Disclosure of spy activities certainly would be a crime if committed in Germany against Germany, so extradition for such a whistleblower would have to be stopped at the political level, which is possible, but that's not something I would want to depend on. The US could exert a lot of very painful pressure on a German government, and as the Snowden affair shows, broad public support is far from given. Might be easier to weather the scandal from giving in than the consequences of sticking to principles.
Maybe my wording is bad; the EU should offer protection to US citizens who expose crimes committed by the US government in the EU. And preferably committed elsewhere in the world, since it's in the world's best interest to know.
What did he expose exactly? As far as I know - according to the US government - foreigners have no rights whatsoever so they could spy on everyone else completely legally. For example - they could install spyware/keylogger on my computer completely legally, because the 4th amendment doesn't apply to non-Americans.
Maybe... they haven't told me. I am also not sure if the EU is running large scale wiretapping operations in the U.S. and I think that the U.S. would react in a drastic way if they learned about it - as opposed to the EU.
What I do know: U.S. citizens are protected by GDPR when they are in the EU.