How can DoD drones over the U.S. be done lawfully?

"homeland defense purposes" is a very vague term and can be stretched through "creative use of policies." When combined with units outside normal USAF (like Air National Guard if they have any) it could "potentially" side step legal prohibition (that which is not prohibited is allowed).

But to invoke Occam's Razor "better to ask forgiveness than permission" combined with the "availability of a tool increases the willingness to use it."

The NDAA of 2012 designated the CONUS and every US Territory as a "battlefield," thus military operations are entirely legal within the US. This also effectively disables the "Posse Comitatus Act."

I sincerely doubt that the statement in the article that "spy drones on non-military missions have occurred fewer than 20 times between 2006 and 2015" is even remotely true.
Here at NAS Corpus Christi, TX, Homeland Security is co-habitated on the base and they have two Predator drones that fly regularly. I would guess by what I've seen that they probably fly at least that many times in any given quarter.

Add: The stated mission of these drones is drug interdiction and immigration surveillance. Where that falls on the legality scale is for someone else to answer.