Because corporate security is... the positive spin is probably "heuristics" or "statistical", the negative spin is "cargo cult". Lots of scams use(d) .xyz domains so just block the whole TLD. Whether this is a good cost/benefit is left as an exercise to the reader.