I imagine it's to avoid getting sued by the company behaving poorly. Companies bring lawsuits against good-faith security researchers all the time to try to silence them, so if you were a researcher, why would you expect the one company among the several you researched who's potentially misbehaving to not misbehave by trying to sue you into silence?