Something can be a pretty big deal in terms of security, and get dressed up in sensationalism by news outlets to get more clicks. They're not mutually exclusive categories. But it's the "we can get clicks by reporting more of these" that most folks notice, rather than the reporting being in lockstep with the number of hacks being perpetrated every month/week/day for the last 4 years.