"Hey boss, this investment has possible earthquake risk, but that seems very remote; do I have to put that in?"
"Yeah, put it in. No one reads the document anyway unless it goes to court and in that case, you can get dinged for leaving out stupid risk factors, but not for having them in."
My favorite risk factor was "Timothy Sykes doesn't like us"
Did not read the study itself. My explanation would be that since companies are not changing these for fun, they are probably changing them because they see some previously unexpected risk possibly manifesting itself and want to cover their back.
Unfortunately, I can't find the pointer to the study or the article.
Edit: Found the article, I guess this was posted to HN: https://www.theatlantic.com/magazine/archive/2018/09/the-sec... (search for NetApp to find the part about the study)