Been in or around tech my whole life and this is the first time I've heard of security.txt. This article is trying to shame or something over what even https://securitytxt.org/ is calling "A proposed standard..."?
It’s an interesting proposal, but trying to shame people into adopting proposed things is more likely to generate groans and disinterest in 2025 than to win converts.
But when you conflate that with some sort of expectation or "minimum effort" and try to shame people with it you signal something else, particularly to people who disagree with the value of said standard. I've had people show me my domains on "DNSSEC Hall of shame" site and my opinion of that site's existence lowers every time.
In other words, someone had an interesting and possibly good idea, and did the non-trivial to get it published as an RFC (getting even informational RFCs take considerable effort) and now someone (else?) is trying to misrepresent its status.
As said in another comment, "nothing burger". Also, {click,flame}bait.