Following your organization's data security practices is not immoral. To me, refusing to accept a PDF is no different than running a cash only store and refusing to accept credit cards as payment.
The US government manages a more diverse array of problems (critical, life and death problems) than any other US organization (and probably more than any other org in the world). Amazon has only a tiny fraction of the competence of the US government and is not nearly as reliable. Remember the last time a significant portion of the social security system went down? I can't, but I can remember the last time AWS went down.