America's largest companies have no simple way to report security flaws

Probably because security@domain is inundated by low effort, low value beg bounty bullshit.