Because if they don't have this, then this is bad security advice against what is considered a targeted attack.