Thanks for this post. Gives more than enough reasons not to use security.txt. Having it in a place which requires human interaction to form a contract makes more sense. Cant automate that.