Many sites have little (real/legitimate) traffic outside of their country. Traffic from most countries also generates a lot less ad revenue per user than US or other “rich country” traffic. That means the sites have a limited motivation to allow access from other countries.

At the same time, allowing traffic from other countries may force them to deal with a lot of spam/hacking/DDoS/scraping/bot and general garbage traffic, and complying with foreign privacy laws like GDPR.

This makes it easier to just block the traffic.

This is particularly infuriating when it’s a government web site and you’re a citizen abroad trying to access an essential government service. (In those cases it’s mostly done to avoid malicious traffic.)

US news sites often do it because they get little non-US traffic and their sites are absolutely infested with ads and trackers that they can’t make GDPR compliant with any reasonable amount of effort.