Unless there's a way to mandate that the security team's contacts listed in security.txt actually respond in a timely manner to security-related messages that a

Unless there's a way to mandate that the security team's contacts listed in security.txt actually respond in a timely manner to security-related messages that are sent to them, then I have a nagging feeling that: * well-run organizations won't benefit from doing this, since their security teams were already easy to reach and * poorly-run organizations won't become any better by doing this, because one text file doesn't fix a broken org