I would have expected their rationale for not sharing being that bad actors could check and adjust source material to avoid any hashes in the DB (which would undoubtedly be leaked to them) — not the rationale that they provided.