They might want to add a page about not publishing their security guidelines for potential attackers to read and learn about potential gaps. It's security thro

They might want to add a page about not publishing their security guidelines for potential attackers to read and learn about potential gaps. It's security through obscurity, sure. But if someone reads this and thinks there is indication of low-hanging fruit, they become a more tempting target. On the other hand, by posting this, the organization will learn from the collective wisdom of anyone reading and providing comment (and perhaps any resulting other activity), so at least this has potential to provide improvement.