Why are companies not legitimate sanctioning authorities, even when people speak of "corporate sanctions" or "self-sanctions"?

Because only governments have the legitimate power to issue binding rules for a collective of actors and to impose coercive measures that restrict property rights; a company leaving a country is a private decision, not a sanction.

Just war theory's principle of legitimate authority makes governments the key authority in war. By extension, only state governments can decide on coercive measures that limit the property rights of individuals and organisations, which is what sanctions are.

Labels like "private (corporate) sanctions" or "self-sanctions" for companies that withdraw on their own therefore describe something that has no legitimate authority behind it. This matters for the paper's conclusion. When companies withdraw en masse beyond what states decided, they effectively impose sanctions that nobody with authority chose, calibrated or can control.