As someone currently working there (in tech, not the newsroom), this is partially correct.

Second order effects can become a consideration, but the bar is high. Usually “will this place someone in immediate, specific danger of harm” vs potential risks.

As a recent example, journalists covering Iran in the past week had sources confirming the downed airman was located, but that the extraction planes had been unable to take off, and held off on publication. Same for advance knowledge of the Maduro raid. Both examples have been confirmed publicly by those journalists.

Not defending this particular decision at the moment, but someone who potentially controls Satoshi’s wallet has much more ability to protect themselves, and their desire to remain anonymous wouldn’t factor in.