Right, the entire PDF.

You can't just create a tiny csv of the records you want. You need to upload GBs of data which is easily noticed by any of the routers involved.

Although I mean just because somebody noticed data is being leaked they might not have the authority to stop that doge employee or whomever.

Presumably the pdfs are so large that moving any significant chunk of them over available bandwidth takes so much time, and requires so much storage, that doing so just isn't useful for the attacker.

While I don't know any of the relevant numbers involved, imagine a scenario where exfiltrating even 10% of the total data would take years. What would be the point?

A malicious actor can target individual records, but leaking a lot of them becomes impractical.