I get what your saying but humans are humans, journalists are busy and security is a pain for most people (until they need it).
The threat model really depends and so is too wide for me to make any sweeping statements. Clearly a US journalist working on drone strikes is a different threat model to an democracy activist in Sudan.
...until they see they need it.
Sad, as most people may not even know that they need to go to these kind of depths. For them, TBB seems more than enough.
The problem with this mentality is, often its not themselves they're protecting but others. If Alice and Bob are communicating, and only Alice is the one under threat: Alice may be willing to go to great lengths to make her side secure, but you really need to be making it as easy as possible for Bob, who has less of a direct incentive to overcome the inconveniences.
I feel the urge to mention https://chatsecure.org/ as a notable middle of the way alternative.
If you're going to be actively targeted by exploits like this, then you shouldn't give a damn about some of these tradeoffs. If you have journalists/activists willing to go to information war with a nation-state, they shouldn't be surprised when their adversaries have the resources to pwn them. If David wants to fight goliath, they will need to take this into account. The guys with guns and power want their heads.
If the activists/journalists/whatever don't want to take the necessary precautions to use computers to talk to people in a way in which they are protected from capable adversaries, then I'm not sure what it is that they are expecting.
Also, I was recommending these users simply defending in depth by using Tails as a sandbox for a leaky browser, to require a chain of expensive exploits (browser 0day + VM escape 0day). Training someone to install VirtualBox or VMWare and run an ISO from it doesn't really disrupt too much workflow and defends in depth against the browser issues, then again I am likely wrongfully assuming VT-x/VT-d and a lot of RAM on the activists' computers.