I actually think this is a good and valid question.
And I think the answer here is - it is because it is. What I mean is that they analyzed a bunch of samples, separated them into malicious/benign, and then found out that when these flags are set it's almost always malware, so it makes a good indicator because they observed it to be a good one.
I can't think of a logical reason. It's probably a field nobody sets on purpose in legit software. Maybe some packers or whatever sets the field in order to alter the files' checksum? Google says those flags are obsolete so setting them should not have any effect at all, but it would change a file's checksum.