ARM V7 document states: "In ARMv7-A short descriptors only be used at EL0 and EL1 stage 1 translations. They cannot, therefore, be used by hypervisors or Secure monitor code."
Why stage2/hypervisors/secure monitor cannot use short descriptors? what is the limitation?
Compatibility. The short descriptor format is the older/original format. When it was first introduced, all the world's code would have been written to use short descriptors. It takes a while for code to adopt newer features, you need to provide a migration path.
At S2 it is easier, as LPAE and virtualization were introduced at the same time. Meaning there was no "legacy" Hyp mode code using short descriptors.