Hi,
It's not a security issue. HikaShop doesn't attach the downloadable files to the emails because attachments are limited.
First, you don't know the maximum size of attachments that the email server of each of your customers can handle. So if your PDF is 10MB and some of your customers have a limit of 5 MB for the attachments of the emails, then they won't receive the notification email with the attachment.
Second, if you sell several products with downloads each one would need to be attached to the email, increasing the problem of the first point above.
Third, adding attachments to emails slow down the sending of the emails. In some cases, this can cause the pages to crash when the max_execution_time of the php is too small and/or the files being attached too big.
Fourth, adding attachments to emails can often increase their spam score, leading to some of your customers not receiving the emails.
So because of all this, in almost all the cases, it doesn't make sense to directly attach the downloads to the notification emails.
Note however that HikaShop automatically add to the emails a direct link to the downloads so that the customers can click on it and download securely their purchased files.
Now if you really want to attach files to email notifications based on what is being purchased, you would have to write a plugin to do it. So it's not impossible, but there is no easy option you can just turn on to allow that for the several reasons listed above.