I thought it's aimed at humans, not robots.

Humans aren't going to trip up at some extra ''s.

Since it has a structured data format, computers will parse it sooner or later. Why bother setting off comments with `#` at all if it's purely for human consumption? Why even have a standard, security.txt could just be "this is the place where you write whatever you want to about security, here are some suggestions as to what other people might find useful".

I'm not hearing good arguments for not making it TOML...

You might not want robots to parse it. See the spam complaints in the rest of the thread.

It's not illegal to put TOML in a .txt file.

It clearly has some INI-style format. Why not a well-specified one?