Because that is a user-facing page, and this is a developer(/hacker?)-facing page. Anything listed on the contact page, particularly for larger organisations will get contacts from any slightly annoyed user who hasn't been able to make contact through other methods.

By putting this in a non-trivially discoverable (yet well-known) location it should cut down on exactly the kind of noise that makes keeping security vulnerability reporting channels open and clear hard.