Yes, there are many routes where military equipment can make it's way to unauthorized persons.
Back in the 60s I worked at the US Army Missile Command in an office with over a dozen file cabinets that were stuffed with Confidential and Secret documents on then current, missile systems. Many military secrets were there. We went to great measures to insure it was all either being constantly watched by one of us or all the cabinets were locked, checked, and double checked, usually at the end of each day. But we had little doubt that the Russians already knew at least 95% of it. How did they get it? EVERY WAY they could.
Keeping military secrets secret is a very, very difficult task.
I would be very surprised if the Russians did not have special squads roaming the battlefields grabbing whatever they can find. And likewise for the Ukrainians and even some US personnel. Heck, Ukrainian farmers are hauling Russian tanks behind their tractors, probably to turn them over to their army....
That would not surprise me, but between the age of the design and the U.S. military's poor inventory control, anyone who needs them has probably already collected and parameterized enough good examples. A quick search for javelin missile "stolen" gave a Ukranian market price of $30K/unit.