I think it's mostly the "you need to monitor CVEs and write report within 24/72 hours" that causes OEMs pain and they prefer to have less work than more.

Also - the reality of what you think is ok and what a corporate legal department think its ok is... rarely the same -_-

Law: please do the minimum to protect users. Corps: screaming