[oefrha]

Using WKD is also a good way to solicit useless “security”-related emails from people running questionable automated scanners.

[Boulth]

I think you confused this with security.txt standard. WKD is not enumerable (unless explicitly configured like that) so the issue doesn't exist.

[JBiserkov]

That's why we can't have nice things :-(

As soon as something is well-known, it will be abused by spammers/scammers.