Am I right to think of it more as a partnership? It does take at least one person with insider knowledge and access. Otherwise, the reporting would lack the backing documents that brings it credibility. And companies seem to be rather opaque to purely outside sources.
Unfortunately it's not just that. A few years ago a friend reached out to a few investigative journalists with documents about wrongdoing at a big co. No response. This was at the time of the Mossack Fonseca hack when many of those same publications were calling out individuals who owned offshore companies, even when it was perfectly legal for them to do so. Maybe she was unlucky, but my anecdotal takeaway was that perhaps it simply required less work, and got more clicks than real investigative journalism.