Presumably out of concerns for liability/security. Presumably they will roll it out at some point, with the ability to lock it down at an organization level rather than (just) the account level. But they might not feel confident they understand what controls to add until they've seen it in production.