Because they're not the only person the security team is dealing with? Because they need to verify the claim and see what it really affects? If there are other

Because they're not the only person the security team is dealing with? Because they need to verify the claim and see what it really affects? If there are other repercussions? Because you don't want to tell more than you need? (a security researcher should know that) Vulnerability disclosure is the closest thing to a protection racket that is actually legal. So it's natural that people will be on the edge. Sure, it beats the alternative.