I'm pretty sure that's the reason. While identifying vulnerabilities in the actual airplane is high-value, it's also high-risk. Even the most cautious researcher can easily affect a system being investigated, which is potentially financially costly for a website and potentially fatal for an airplane in the air.