What sensitive data do you think is on a loan estimate? I've received a dozen over the years and it's literally just your name and the address of the property you want to buy. Both of which are public information if you do purchase the property.
Scammers pay a lot of money to people who can get them those kinds of lists.
Title company called and left a voicemail saying they emailed wire instructions and to call to verify with them then check with lender on correct closing amount. The email came from the title company domain so it was easy to verify but literally anyone could have called and mentioned the same.
Anyways the security could be fine. But if a user's primary action is uploading that document then maybe wanna have more than a quick sentence on it.