Why would it be if nobody trains them on it?

There are several groups out there that train journalists (and others) about digital security.

https://freedom.press/digisec/

https://tcij.org/initiative/journalist-security-training/

https://ssd.eff.org/playlist/journalist-move

That doesn't obviate the practical reality that "nobody trains them on it". Someone can be available to train them but, if that resource is not utilized, then the fact remains that they weren't trained.

People train to become journalists, wouldn't these practices be part of the curriculum?