As Brian Krebs reported in the "dumpster fire" article the response site was setup by their PR company. Perhaps they did not want to give away ownership of part of their domain... For security reasons

In fairness, I could easily see people ignoring the subdomain and just going to the main site. Of course, that probably happened anyway.