It is true that "standing" is an important doctrine: the requirement that a person first prove that they have been uniquely harmed by a law they want to challenge is not only necessary to fulfill the Constitution's limitation on the federal court's power (which confines their authority to actual "cases or controversies"), but it also prevents the Court from acting as a free-floating arbiter that rules on every political question. Courts can only rule on actual cases where one party has concretely harmed another.

The plaintiffs, however, have argued that although they cannot prove they or their clients and sources have been targeted, they are already being harmed by the existence of this law. They have ample reason to fear, they say, that the communications they have with their clients or sources are targeted for interception by the government. That means that this law forces them to refrain from communicating, or to expend substantial sums to travel across the world to meet in person with them, or that these clients and sources refuse to speak to them out of fear of being eavesdropped on. These concrete harms mean, they say, that they have standing to sue the government and obtain a ruling as to whether this law is constitutional.

In 2011, the Second Circuit Court of Appeals rejected the Obama DOJ's arguments and ruled that plaintiffs had standing to challenge the eavesdropping law given the concrete harms they are suffering from the mere existence of these eavesdropping powers. Rather than defend the constitutionality of the law, the Obama DOJ appealed this decision to the Supreme Court, and asked the court to dismiss the suit on standing grounds, without reaching the merits of the lawsuit.

Volokh has a lot more background of the case, where they discuss that this issue was "facially" challenged, and not challenged on an "as applied" basis, and that most Fourth Amendment facial challenges are generally not successful:

From Volokh:

Much of the discussion in the opinions concerns the fact that this is a facial challenge, not an as-applied challenge. But there's an underlying oddity that the opinions don't mention: Facial challenges are generally frowned upon in Fourth Amendment law, and it's not clear that the law permits one to be mounted against the FISA Amendments Act at all even if plaintiffs have Article III standing. The key case is Sibron v. New York, 392 U.S. 40 (1968), in which the parties tried to litigate a facial challenge to a stop-and-identify statute. Sibron appears to say that you can't bring an facial challenge to a statute that regulates warrantless searches and seizures: Facial challenges can only be brought against statutes governing the issuing of warrants.

SNIP

Sibron explains why there is relatively little law on Article III standing to bring Fourth Amendment facial challenges to statutes. Facial challenges are generally not allowed in the first place -- at least unless the case challenges a regime of issuing warrants -- so we haven't seen many battles over Article III standing to raise challenges that can't go forward anyway. Instead, Fourth Amendment law has focused extensively on "standing" to bring as-applied challenges, which the Supreme Court in Rakas v. Illinois tells us simply folds back on the Fourth Amendment question of whether the government conduct violated the plaintiff's own reasonable expectation of privacy.

From the Second Circuit opinion that led to this appeal (emphasis mine).

The merits of the plaintiffs' claims are not before us. The only issue presented by this appeal is whether the plaintiffs are legally in a position to assert these claims in a federal court, not whether the claims are to any degree valid. Their merit is an issue for another court on another day.