Journalists are taught this by those that really know security and opsec, infosec.

OP is getting downvoted, but I have seen high-grade security people recommend the Google apps suite to journalists and scrappy human rights NGOs etc. (some of whom do dangerous work, and have high security needs) with the argument of "you can't afford better security, so you're better off outsourcing it". This is a practice that exists, for better or worse.

People can't afford Qubes and/or layered Virtual Machines?

Hopefully we're talking time-value.

They really can't. It's very rare for a scrappy human rights NGO to even have an IT person. Access to IT skills are largely via auditors/consultants who rove around, doing it close to pro bono. Those consultants in turn try to maximize the good they do and spread it around, and that's how advice like this happens. It's basically IT field medicine. What you're suggesting is the equivalent of a top-grade operating room with attendant staff.

Disclaimer: I do volunteer work in a human rights NGO. We interview North Korean refugees about execution and burial sites and record the data in a GIS and incident database. I'm also a Linux desktop developer, and help them run their IT. But I've rarely seen this anywhere else.

how to opsec: upload your sensitive documents to a cloud service that totally won't get hacked

If the data isn't sensitive there's nothing to lose