You have to keep in mind the time when these requirements to "use fax" for security came about.
There was a single telephone company (or it was shortly after there were plural "baby-bells") and the telephone network was a completely private, isolated, network that only the phone company (or baby-bells) even had access to. It was also a network that was heavily regulated such that the possibility of a random attacker from half a world away being able to tap into a phone call as it happened simply did not exist.
In that environment, placing a phone call was considered "secure" (or at least as secure as network isolation and regulation could cause it to become [I'm ignoring NSA style 'state secret' taps, those have likely always been available to NSA style agencies]). So it would have been seen, at that time, as reasonable to use fax machines for document exchange, because the "phone network" was considered to be secure against having a man-in-the-middle tapping off one's communications.
Wind the clock forward thirty years, and have the once isolated and highly regulated telephone network more or less become just another packet protocol on the general Internet, and the choice of using "fax" for secure document exchange sounds ludicrous.
The issue is that the regulations those environments operate under have not been updated in the ensuing thirty years to account for the fact that "phone network" is no longer the once isolated, mostly secure, network it once was. And if the regulations don't get updated, no lowly clerk at the front lines is going to lose their job by _not_ using the comm. system called for by the regulations.