Because the complaint isn't about the vulnerability disclosure, it's about Ars knowingly publishing inaccurate information, i.e. libel.