[esafak]

The risk of lawsuits like the ones threatened to be filed against this researcher.

[lucb1e]

They can also sue the pope but I don't think the pope finds that a risk worth considering either when they didn't do any hacking, legal or otherwise. How would an organization get sued for hacking when they didn't do any hacking and are merely passing on a message?

[esafak]

They would call it abetting. It's not as if the site doesn't know what it's disclosing.