Because if a bureaucrat officially states that risk is LOW and an attack happens, that bureaucrat's own ass is now at risk. So keeping it at SUBSTANTIAL keeps

Because if a bureaucrat officially states that risk is LOW and an attack happens, that bureaucrat's own ass is now at risk. So keeping it at SUBSTANTIAL keeps that ass covered. Incidentally, this also applies to travel advisories, which are very quick to ratchet up the threat level and very slow to climb down.