Perhaps because they are discussing critical system vulnerabilities, some of which would be disastrous if they got into the 'wrong' hands before they were patch

Perhaps because they are discussing critical system vulnerabilities, some of which would be disastrous if they got into the 'wrong' hands before they were patched? And, from Symantec's own page: Symantec strongly recommends using encrypted email for reporting vulnerability information