I investigated this while at Capital One (a couple of years ago) and the main reason was that banks would still be liable for any data leakage that the third party (or in this case you the user whose data it is) would perform, so to make it a little(?) safer it'd be easier to restrict it.

Agreed it's a sucky situation for folks who want their data and could accidentally leak PDFs with the same result 🤷🏽‍♂️

Also as someone who's implemented Open Banking on both consumer and service provider, it's not necessarily something I'd expect lots of folks to enjoy doing themselves 😂