Why does PSS produce an EM message that's almost as long as the modulus? I try to understand the reasons behind the design of PSS scheme for RSA. Why is the length of the EM message (that is, the result of PSS transformation just before signing) equals approximately to the size of the modulus? Why PSS does not use a last call to a hash function (for instance SHA-256) so as to reduce the size of the resulting element before performing the exponentiation?
To prove that, for a generic hash function, forging PSS signatures is not much easier than computing arbitrary $e^\mathit{th}$ roots modulo a large composite of unknown factorization, we need to grant the attacker, who is trying to compute $e^\mathit{th}$ roots, oracle access to a forger for a signature scheme that uses the entire set of residue classes $\mathbb Z/n\mathbb Z$.  That way, any attack enabling forgery also implies way to solve the RSA problem at only slightly more computational cost than forgery.

If we granted the attacker access to a much more limited signature scheme that only revealed $e^\mathit{th}$ roots of a very small subset of possible residue classes, then an attack on that would not necessarily imply an easy way to solve the RSA problem.

And there are pitfalls with signature schemes involving subsets of the residue classes: e.g., if a signature on a message $m$ is defined to be an integer $s$ with $s^3 \equiv H(m) \pmod n,$ you may be tempted to test the similar-looking criterion $(s^3 \bmod n) \equiv H(m) \pmod{2^{256}}.$  Although $e = 3$ is a good sensible choice for near-fastest verification in a well-designed signature scheme (only $e = 2$ with Rabin–Williams will beat it), this modified criterion gives the adversary leeway to find a cube root by varying the higher-order bits of $s$ until they get an integer perfect cube whose low 256 bits happen to coincide with $H(m)$ for some chosen $m$.  Our friend poncho here sketched a similar attack on a variation on this theme several years ago.

This doesn't mean that a variant of RSA-PSS using a short hash would be insecure: only that we don't have confidence it can't be much easier than solving the RSA problem in general.  Compare, for example, Rabin–Williams, which can't be much easier than factoring the modulus—but we don't discard RSA-PSS simply because we haven't shown a reduction of the RSA problem to factorization.  For a similar example, see my proposed not-quite reduction of RSAP-KEM to factorization.

That said, having the security reduction helps cryptanalysts to focus their attention on a small number of problems—the RSA problem, factorization—for a large number of cryptosystems, instead of having to divide it among potentially much easier problems for each cryptosystem like RSASSA-PKCS1-v1_5, of which naive implementations may be vulnerable to the low-exponent attack I described above.  The security reduction guarantees that there isn't any much easier attack on the specific cryptosystem, so the cryptanalyst's attention might as well be focused on the general problem.