America's largest companies have no simple way to report security flaws (this.weekinsecurity.com)

Probably because security@domain is inundated by low effort, low value beg bounty bullshit.