I get the impression that some of the big name CAs are ... not very technology oriented, you might say. They focus on the sales side, and treat the actual issuance and revocation of certificates as an unfortunate cost center and minimize investment.

Most of their process is 100% automated. Revoking based on free-form reports would at the very least require a human to deal with the report.

Also, customer service for dealing with the certificate holder.

That said, offering an API and automating as much as they can is a lot easier than receiving the reports through free-form e-mail, with followup through Mozilla's root program (https://wiki.mozilla.org/CA/Bug_Triage#Compliance_Problems_a...), where the CA will have to take action or cease existing.

You need to notify the customer and then deal with the support work when they roll the key. Also they will get some blame from the customer for having to deal with the situation. All that without much extra payment. It's much more profitable to not care.

The CAs have automated signing and have zero labor in that part. Revoking is a manual process, infinitely more labor intensive.