Hmm, sorry I haven't heard about that incident, but pretty possible. As I've said, the best practice is to know where to click and where not to click, in case of a simple user. If you are going to ask an Apple they will tell you that there's no need to install thid-party solution for most of your activities, however you can try a software as you specified, but I cannot see a legit reason for that, except for the case where you are a person of interest that's continously threatened by script kiddies or just doesn't have the time to know how to handle software adequately. I also know that they fixed the well-known SIP feature exploit that was a terrible vulnerability in El Capitan and also the macro viruses (in Office 2016 you can reportedly keep them on without the worry of being affected by a virus). There will still be exploits, but they pale in comparison to what's on Windows in terms of vulnerabilities.
My team is working only on Mac machines, having Linux distros, Windows instances etc. and haven't got infected once on any of them (apart from the sandbox Ubuntu VPS which receives brute-force attacks daily, but you cannot call that "infection"). Windows is a more sensitive subject, I wouldn't discuss it here, but again with a bit of effort you can avoid them without spending money on a subscription. I know seniors that have the same opinion as me.
I am really curious how that journalist got infected and by what means (on Sierra I assume?). Perhaps, it's pretty common for people to click on ads like MacKeeper or similar adware (I said MacKeeper because it's the most prevalent one and many relatives got a ton issues by installing random software which shouldn't have been installed). At least from my knowledge, if you download an executable (a .dmg file) you will probably won't get infected unless you don't accept the several popups and warnings that GateKeeper will raise upon opening. There are however some improvements that can be made to the basic firewall protection provided by Apple.
If I were to hack or breach somebody's laptop which is running macOS I would do it via a trusted person which has access to that device and with a USB device coded to be recognized as a peripheral and have root access by default. In the first case, if the person gets to the laptop without being detected, you would be saved by FileVault (if somebody tries to access you data by any method he or she will need the iCloud pass) and in the latter you can't be saved by anything, because the peripharals are always marked as trusted by an operating system even if the device isn't a peripheral. This is in fact a widely used method for hacking, because with root access you can basically get anything you need from a user. Excluding these really extreme situations the GateKeeper and the basic firewall emodied by macOS will suffice the security needs of a regular user. At least it's done the best for me in my day-to-day work.
