This sends 2 clear signals:

- for developers: don't report, it's not worth it

- for users: Google does not care about security as it doesn't pay for reporting (enough).