Because that approach works so well in the United States.
Well, no, but that's more so do with our piss poor way of reintroducing them to society. Oh, you served time, here you, you're free. You never taught them a new skill or gave them methods of leading a different life - so they go back to what they know. Same is true of all types of criminals in the US. It's not the punishments that are supposed to learning lesson. Too many parents do that to their children - grounding them as if it's going to teach them something. Yes, grounding is a consequence for the child's behavior and should be enforced, but you also have to teach them along the way what is and is not appropriate and how to find fun in better ways, etc.
Otherwise what do you think the kid is going to do? The same thing all over again. They will just learn to live with the punishment.
So, imprisonment is an appropriate punishment in this case, but showing them during this time how to be better citizens and people is just as important, and in the US, we typically skip that which means a very low criminal reform rate.
Personally: this kid didn't even get a slap on the wrist. He got 2 years probation (that's what suspended 2 year prison stuff is in finland) and he has to become an activist for prevention (likely doing a set amount of speeches about why it's bad). Meanwhile, he's alowed to have full access to computers and do it all over again, this time learning from his past mistakes and getting even better at hiding it, with a nice mask of "but I'm an activist!"
Keep in mind, it's not just the DDOS attacks. I guess I can get going a bit light on that. But swatting? Shit that endagers real human lives? Sorry, you need a real punishment for that. He was handed a handy excuse to do it again without getting suspected, and told he can't lave his home area, as if he really intended too anyways. Silly.