> We continue to reach out directly to those sites that we identify as particularly high impact and try to notify them, though this is happening on an admittedly small scale. The process of responsible disclosure consumes a lot of resources, use of security.txt is low, and the vast majority of our emails and messages go unanswered. It's simply not possible for us to scale this up.

...why?

Some of the sites collect credit card information. Wouldn't they have a 'contact us' or some other legal identity information required for collecting and charging cc's?

Other than looking at security.txt what else have they tried? did they try programmatically checking for a 'contact us'? or the old trick of emailing 'webmaster@domain.com' or 'admin@domain.com'? did I miss those details in the article?

Maybe things have changed in the past 10 years, but it was a MASSIVE deal if a website ended up on some site claiming it has malware. Like, contract-ending, people-getting-fired, 10s of thousands of dollars in lawyer fees kinda deal.

I don't think 'it's hard' is a good excuse to ignore responsible disclosure