My question is that why does the locking script for multsig address contain their public keys instead of PubKeyHashes(addresses)?
Why would it?
The reason for using a hash of the public key in P2PKH is because it resulted in shorter addresses (in Satoshi's time, before compressed public keys, public keys were 65 bytes, so using a 20-byte hash was significantly shorter). Such an argument does not exist for bare multisig, because there exists no address for bare multisig.
In P2SH (or P2WSH) multisig, the issue does not apply either, because what is given to the sender is an address that only contains a hash of the locking script. Whether or not that script uses pubkeys or pubkey hashes does not affect the size of that hash. Using an additional redirection inside the script there would also just be a waste of resources (because at spend time, both the pubkey hashes (inside the locking script) and the full public keys (as inputs to it) would need to be passed).
And also isn't it dangerous for the receiving party(multsig owners) to reveal their public keys to senders
There are certain cases where the senders will know the receiver's public keys, but in general, this is not the case. As said, no bare multisig address type exists, so most commonly, P2SH or P2WSH multisig is used. In that case, the sender only receives the script hash from the recipient.
Regarding the security reduction, my own (and apparently somewhat controversial) opinion is that the pubkey hashing does not meaningfully contribute to Bitcoin's security, and while it is frequently repeated, this is cargo cult. Reasons are:
- If ECDSA is broken, any attacker cooperating with miners can already exploit it (because unconfirmed transactions reveal public keys).
- Millions of BTC are stored in outputs with publicly known public keys. You can't realistically hope that BTC holds any value after it's assumed ECDSA is broken (as long as ECDSA is commonly used).
- Tons of interesting use cases involve revealing public keys to other parties (such as Lightning, or even just multisig between the signers). If we were seriously concerned about ECDSA's security, we shouldn't just be discouraging these, but going as far as outlawing them. That doesn't happen, because ECDSA is part of Bitcoin's security assumptions. Dealing with it being broken is done by migrating to something else, not by patching it up.
There are other answers on this site which go into more detail about it.
