Interesting observation, something I’ve not noticed before.
I did a couple of tests.
Some existing PDF uploads do link directly to CDN:
Some existing PDF uploads do not use the CDN:
What’s the difference? 
I don’t know 
I’d need to check more examples.
I tried a quick test by DM’ing myself and a new post, shows /short-url/ as per your details:
Clicking the link then pulls directly from the S3 bucket, again as per your description:
I’m not quite sure why some of our posts do use the CDN and some don’t, but I can replicate some of what you’re seeing.