That is a fair and valid point. Not sure I agree with it, because your preference still implies something it may be not, whereas “unknown substance” is the most exact and correct term for what it actually is at the time the article was written. I don’t necessarily disagree with you either though. See where you’re coming from.

If someone is whacked out enough to spray a pepper spray can on a train, why are you so quick to assume they aren’t whacked out enough to fill it with a different substance? It’s called responsible reporting (admittedly shocked I’m saying that about the sun) to not state an obvious assumption as fact until it’s actually confirmed as such…