I can almost guarantee that most of those outlets have more stringent policies regarding fact-checking and quotation than the "average" internet source.
"Lazy" might not be the right word...all of the tech journalists I have personally interacted with seemed to be pretty good at their craft overall and actually cared about what they wrote. However, this doesn't change the fact that almost all media companies and their journalists are woefully inept at fact-checking or writing stories concerning information security, including DDoS attacks.
That's one specific (and extremely counter-intuitive and complicated) area where reporters probably have weak domain knowledge. It's somewhat unfair to extend that criticism to every other part of human existence that journalists report on.