If every site responded, upon request, with their patch level, a database could easily be created.
Or a scan becomes that much easier to perform on 100,000 endpoints - and then your targeted attacks can begin on only vulnerable systems. 'Exploiters' waste a lot of time trying non-vulnerable systems.
The less information your server exposes to the outside, the better.
