There are several groups out there that train journalists (and others) about digital security.

https://freedom.press/digisec/

https://tcij.org/initiative/journalist-security-training/

https://ssd.eff.org/playlist/journalist-move

That doesn't obviate the practical reality that "nobody trains them on it". Someone can be available to train them but, if that resource is not utilized, then the fact remains that they weren't trained.