In cases like these the journalists can and often do say something to the effect of they were able to corroborate the claims. But you’re super right about being careful, because they also can mishandle the data they receive to the point where they dox the anonymous source, too. That’s what happened with Reality Winner and The Intercept. They botched it, and she was arrested.