I'm sure they have tried compared the leaked documents to the redacted FOI ones and I'm sure they'll have tried plenty of other things to stand them up too. "Reuters has been unable to verify whether the documents are genuine" means exactly that, not that they're questioning their authenticity, there's an implicit 'could well be'. But reporting a story like this would certainly mean digging pretty deep.
I actually used to be on the same team as Jack Stubbs who did the reporting on that. He's currently cybersecurity correspondent, but previously did lots of very strong Russia stories (he speaks fluent Russian and used to be based in Moscow) and is super bright, so he's well placed to report on this.
I don't know if you read this:
But the Global Justice Now story on how they got the documents really doesn't tie up with them being distributed by Russian botnets.