[878654Tom]

One reason why companies would not do this is to give a little bit of protection against zero-days. When a zero-day is released all providers notice a huge scan for the vulnerability. Scanning huge blocks of the internet takes time but if a hacker has a list of companies using which tools and where it can be narrowed down a lot.

AWS/Azure/GCP/... for example have published IP-ranges of services. If a zero-day for any of those services is released a hacker can already narrow down the attack-range and gain a lot of time.

[NicolaiS]

That seems like a bad reason. With a good enough connection and `masscan` you can "scan the whole internet" (single port) in 5 min. Security through obscurity on IPv4 make no sense.