Why is it difficult to encrypt large amounts of information using quantum key distribution? An article last month claimed that Toshiba Corp. and Tohoku University recently broke the record for the amount of data encrypted using quantum key distribution by transmitting "a few hundred gigabytes".

But QKD is merely a protocol for transmitting symmetric keys - the actual encrypted data is later sent over an insecure channel where presumably bandwidth is not a limitation (or at least any limitations are completely separate from the encryption protocol). Moreover, my understanding is that once you've transmitted a single symmetric key, the amount of data that you can encrypt with it is effectively unlimited:

The answer at https://crypto.stackexchange.com/a/2473/76433 claims that for AES-128 the risk of compromise is "very likely" after $2^{64}$ blocks of encrypted data are transmitted, but the answer at https://crypto.stackexchange.com/a/5101/76433 says that for AES-256, after $2^{50}$ blocks of data transmission the probability of data leakage is still only $2^{-29}$. The answer at https://crypto.stackexchange.com/a/66261/76433 is more conservative and recommends only encrypting 64 GiB of data per symmetric key in order to keep the collision risk down to $2^{-64}$.

So it seems that after you've transmitted a mere 256 bits of symmetric key data via QKD, the amount of data you can encrypt is effectively unlimited. (If you want to be extremely conservative and you want the risk all the way down to $2^{-64}$, then maybe you'd need to transmit a few keys in order to transmit "a few hundred gigabytes" of data.) And modern QKD technology can easily transmit millions of bits per second (although whether or not they are actually secure is a separate question). So why is it impressive that large amounts of data were transmitted?

More broadly, is there any real advantage to having a QKD system that can transmit more than ~256 bits? (Again, I'm putting aside any practical security risks of QKD and assuming for the sake of argument that it is indeed secure.)
I believe the end goal is to use the QKD data as a one-time pad, so the QKD rate would need to be the same as the plaintext data rate.  That is the only guaranteed-secure method.  (Although I think QKD might be a bit of a scam.)

Also, you can't use a key forever.  I recently made a 400Gbps AES-GCM encryptor.  You're not supposed to send more than 2^32 blocks with the same key, because it starts to get easy to forge tags after that.  This corresponds to ~8 hours' worth of data.