I think the reason is pretty obvious. They want you to waste more time after you've submitted the security report and maximize the amount of back and forth. Bas

I think the reason is pretty obvious. They want you to waste more time after you've submitted the security report and maximize the amount of back and forth. Basically the hope is that they'd be able to pester you with requests for more info/details in order to "resolve the issue" which would give them more time to exploit their targets.