CRA is responding the Apache Struts vulnerability.  They nearly got badly burned on Heartbleed, so I think it's a case of extreme caution.

The fix isn't that difficult, and it's fairly easy to tell if your system has been compromised since the hack leaves a trail in the server logs that 's a no brainer to identify.

Speaking for myself, I only ever file on paper.  It's not that I am overly worried about security -- I just think it is awfully presumptuous of CRA to expect us to spend money on software in order to save them money on processing.  An online app for the T1 general wouldn't be very tough to write, but I guess those monkeys think we should pay for the privilege of doing their work.