What is their legal theory though? Have courts found that journalist must retroactively update their previous stories based on new information? Even if they have, is that defamation?

It's quite funnny that a company arguing "we disclosed because we filed an esoteric (in terms of public disclosure) security filing" to demand that Krebs retract his previous story; maybe if he opens the front door and shouts "Sorry!" it would meet their level of communication?

Is it his job to authenticate the source, or, to authenticate, verify and validate the information in the story?

The standard for defamation is:

. knew that the statement was false and defamatory, or

. acted with reckless disregard of the truth or falsity of the statement in making the statement, or

. acted negligently in failing to ascertain whether the statement was true or false before making it.

Not vetting your sources can be seen as acting in reckless disregard of the truth or acting negligently in failing to ascertain whether the statements were true.

Of course, the story was posted on his blog. That's 100% his duty, or at least if he wants to maintain his reputation as a journalist.

Considering he considers his work "independent investigative journalism", I'd say that it is.