While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally fall into this category.
This got me thinking about why they in general omit user enumeration vulnerabilities? Do the websites not care about usernames leaked over their forms or an bot crawling to created automated accounts?
This question is not concerned about any particular webapp, I just want to know about the general reason behind it.