What if using a block cipher as compression function in Merkle–Damgård?
One issue is that it would make finding preimages significantly easier; with $O(2^{n/2})$ time rather than $O(2^n)$ time.

Here's how you would do such a search:


Select $2^{n/2}$ distinct initial halves of the message, and determine the intermediate state for the hash after processing each message.
Select $2^{n/2}$ distinct final halves of the message, and starting with the target hash, compute hash state backwards, determining what the state would have to be at the start of the final half of the message to derive the target.
Scan through the two lists to find a common state.


Once you have a collision, the initial half and the final hash concatenated together will hash to the target.

Making the hash compression function noninvertible prevents this, as it blocks the second step.