Because if they don't have this, then this is bad security advice against what is considered a targeted attack.
Reply on news.ycombinator.com