Presumably the pdfs are so large that moving any significant chunk of them over available bandwidth takes so much time, and requires so much storage, that doing so just isn't useful for the attacker.

While I don't know any of the relevant numbers involved, imagine a scenario where exfiltrating even 10% of the total data would take years. What would be the point?

A malicious actor can target individual records, but leaking a lot of them becomes impractical.