One of the reasons is they are dealing with security related bug reports. Public disclosure before having a fix in place puts users at risk.

Besides that 'security' is a process that all groups are responsible for. So it can't help being _developed_ in the open if the project is open. Which Brave is.