He didn't have to hide his identity from a WSJ reporter because journalistic sources are protected by similar set of laws. To the readers of WSJ he was just a "confidential source".
In the article it says "In March 2014, he anonymously emailed his complaint to New York officials.."
Then the article says: "In March 2015, Tyler Shultz was contacted by a Journal reporter through the professional network LinkedIn."
Something doesn't match up here. I can only assume that his anonymous complaint did not reach the desired effect in a year, and he went via other channels, using his own renouned last name.
It would also seem rational for the investigative reporter to ping 20-30 LinkedIn contacts who listed Theranos as their employer in hopes that 2-3 would reply, so maybe he wasn't the only one the reporter contacted.
So your theory is that after Tyler's initial complaint, the regulators waited for a year, and then leaked the anonymous complaint to WSJ, which randomly contacted a bunch of employees, including the original anonymous tipper?
Alternatively, another employee tipped off the WSJ (Instead of, or in addition to a regulator,) and the WSJ started contacting current, and former employees, to see if their story had any legs.
He didn't have to hide his identity from a WSJ reporter because journalistic sources are protected by similar set of laws. To the readers of WSJ he was just a "confidential source".