This is alarming, because the job of "newsroom security" isn't the same as the corporate security job. Smart organizational security teams rely on a meta-strategy of collapsing user behavior down to a smaller set of activities that they can track and deploy countermeasures for; this works well for employees ("get everyone on the same ad-blocking Chrome extension that we can vet"), but doesn't account for the journalist threat model. Journalists work in the field and deal with sources, who can't (and wouldn't, regardless) comply with corporate security directives.

What you're hoping a newsroom security practice is doing is building source protection systems, like secure dead drops, while also serving an advisory and harm reduction function for the journalists themselves, so that they can safely open attachments and follow URLs and communicate over social networks. In that environment, you can't just say "no, don't do that, do this other secure thing instead", like you can with company staff.

It's a specialized skillset, and one that security teams are not generally good at.