I never understood why vulnerability reporting was a social practice. The reason for that is because I see computer hacking in this particular context (breaking

I never understood why vulnerability reporting was a social practice. The reason for that is because I see computer hacking in this particular context (breaking into computers or reversing binaries and cracking them) more or less equivalent to breaking into something physical, be it opening a box or breaking into a home. But people don't go up to my home and say how they can break in. Nor do people go to companies and say "listen, if I go in here as some repair guy with a walky talky, security will let me right in! And then I switched into an office suit and talked to Janet at accounting, and she gave me your private financials by simply asking her. Train your reception and train Janet." I understand that you want to keep open source software safe, because everyone is using it. So by helping it to be more secure, that's a win. But why isn't the same happening with companies in a physical sense? The public interacts with them. Or are there 'vulnerability reports' (or whatever you call them) on those things? Then they're simply not posted here.