Many top-million sites and large companies are using security.txt (opens in new tab)

I realize that having text files for various things like this is increasingly popular, but I just don’t get the value vs using something long standing like an abuse contact on your whois.

We have this existing thing that no one uses, so instead of using it we create this new completely different thing that only a small subset of sites will even support and which will only work if you offer an HTTPS service.