Imagine they know of a vulnerability but believe that it's not practical to exploit, or something. Then someone comes along and demonstrates that it actually is practical to exploit. They could say, well, we knew about this already and didn't believe it's practical, so we're not paying you for it.

It can sometimes be hard to convince a vendor that a vulnerability is "their fault" and this policy only increases the difficulty.

Because of the public?

If someone decides to try make a name for themselves by taking a shot at embarrassing MS/Intel/Linux/AMD/other which do you think will have more affect on public perception: intelligent, detailed discussion about practicalities and real world attack/defense profiles, or loud shouty "but what if" reporting carefully word to be as scary as possible?

When I worked at Mozilla on the MDN team, for example, there was a lot of inevitable spamming of "security" bugs which basically boiled down to "MDN is a publicly-editable wiki and hosts code samples" (MDN also goes to some trouble to do that safely). The current bug bounty exclusions are still pretty broad as far as I can tell, and thankfully will automatically throw out a bunch of the worst of the spam.

Same thing happens still with Django. I've considered writing up something with similar exclusions to Mozilla's policy just because it would save time dealing with meaningless reports (though Django would get a few categories the Mozilla policy doesn't, like "it's not a vulnerability if the only person you can CSRF is yourself").