I found some tools online that address some of my concerns about using UTM codes that I think will help a lot.
First, this poster developed a script that removes UTM codes from the URL in the address bar of a user's browser so they are gone when a user copy and pastes the link from there. Doesn't help if people copy the link directly out of the press release but my feeling is that more people get it from the address bar anyway. That should go a long way to make sure there aren't links out in the wild with inappropriate UTM codes attached.
https://websiteadvantage.com.au/Google-Analytics-UTM-Removal
Second, this poster created a script that dynamically replaces the utm_source code with the name of the referring site any time it processes a link where the utm_source code is set to the word "dynamic". That means any traffic that comes from sites that have UTM codes on the links will still have their source tracked properly.
https://www.bounteous.com/insights/2014/06/11/campaign-tracking-dynamic-source/
Now that I have these tools, I'm planning on including UTM tags in my press release links. To build links conservatively per the Whiteboard Friday I mentioned earlier, I'm going to point the links at canonical versions of my pages or at URL's that are 301 redirected to the relevant pages. Still not sure if this is a great strategy so I'd love to hear people's thoughts, but I will try it out and see how it goes in the meantime.