Yeah, regulations are only as strong as the consequences given those who break them.
If people can threaten journalists for money and get away with it, they will. If people who threaten journalists over money are sent to prison, then after a brief transition period it will mostly stop.
It's braindead easy to anonymously threaten people on the internet. It's getting easier to steal identities or create new ones out of whole cloth and cypto wallets means you can't functionally know where the money comes from. I'm not sure attempting to punish people you can't realistically identify can be considered an effective strategy.
Punishing a corporate entity however is much easier.