The real reason you can’t throw it out right away is because if somebody reports a security issue to you, no matter how bullshit it is, you can’t just outright

The real reason you can’t throw it out right away is because if somebody reports a security issue to you, no matter how bullshit it is, you can’t just outright dismiss it at the risk of a snarky blog coming out attacking your security integrity. Even if the blog is complete nonsense, not everybody who reads it will know that, so the risk to reputation is too high. Bug bounties are almost completely full of incredibly low-effort scanner spam. A company can easily end up wasting huge amounts of its precious security budget getting report spammers to leave them alone. You absolutely never want to do anything to attract those kinds of people to your business, unless you have very carefully weighted up the costs and benefits first. I honestly think most of the effort that goes into bug bounties and things like security.txt is just busy work for security charlatans who don’t know any better way to be spending their time.