Question regarding VDP

I recently found a high-impact security issue at a large company that was actively leaking internal documents. I did the right thing and reported it through their official Vulnerability Disclosure Policy (VDP). Here is the frustrating part: Their VDP explicitly states two things: They do not gua