Because if the vulnerability turns into a problem down the line and ends up in court, the record of the payment could come out during discovery, which could be made to look bad for the defendant firm.

Have you heard of Elizabeth Kubler-Ross's '5 stages of grief' model that summarizes people's typical responses to bereavement? EKR argued that people generally go through a cycle of denial, anger, bargaining, depression and acceptance. IME this is a good rule of thumb for how people typically handle any kind of unwelcome news.

In this case:

  o There is no such problem
  o Grr why did you hack us I'll call the police
  o How about you take this pittance and STFU
  o We're just trying to run a business and you ruined everything
  o OK we'll fix it and alert our customers