I'm guessing that if Cisco has a documented/known security issue they are more liable in case of future lawsuits. If they simply don't know about it then they are less liable. Someone did the math and found that non-liable lawsuits are cheaper than paying to have security issues addressed properly.