Apropos of nothing, I think it's past time for risks.txt to go alongside robots.txt and security.txt on websites. risks.txt would declare the contents of the organization's risk acceptance log so the $baddies know not to use those issues in attacks.