Well, you will note that there's a list of "approved targets" (for lack of a better phrase) so the ones not on the approved list might just be the unpatched, insecure ones.
I'm just puzzled on the real reason why there's only an "approved" list. Seems to me, if you want the testing done, let the testers hit where they want or where the path leads.
Biting the hand that feeds IT
