First a thing about terminology. SHA-2 is a a family of secure hashes. HMAC would be the most common PRF constructed from SHA-2, and it is an option to be used for a KDF. We'll ignore this for now as we can assume that the KDF construction that uses a hash can be considered a PRF.
KDF's have been designed with security in mind when it comes to generating a limited amount of keying material. In contrast, if you assume that you can use it as a stream cipher then you can assume that the key stream is generated as bulk, and at the discretion of the adversary.
Moreover, you'd have to prove that the common security principles (IND-CPA, IND-CCA) hold for the KDF. If that's not proven then you are basically using a cipher for which the common cryptanalysis is not performed. This is probably what is meant by the full statement by NIST:
The use of the derived keying material as a key stream (as in a stream cipher) is not recommended because the security of using KDFs as stream cipher algorithms has not been sufficiently investigated.
So they don't claim that this construction is worse than AES (although, given the state of AES, it can hardly be much better). They just say that they didn't investigate or include any studies towards using these kind of PRFs as stream ciphers.
In practical terms the choice is easier though. KDF's are usually pretty slow so this kind of thing would only be an option if AES is not available. Even then you could simply construct a ChaCha20/Poly1305 in software and have a better stream cipher.
If you are hell-bound to use a hash-like construction you could use one of the (authenticated) cipher modes constructed from Keccak, the sponge used for SHA-3.
Because of the availability of secure and efficient stream ciphers, I don't think that the community will be willing to perform a full review of KDF's as stream ciphers; KDF's are not a tool to directly achieve confidentiality.
That all said: hen it comes to practical security, I would not worry overly much if the construction would be used as practical attacks on this kind of PRF are unlikely to succeed. I'd however make sure that the stream cipher would be used on limited amounts of data for which the KDF was constructed.
Beware that many KDF constructions have special ways of handling requests for output keying material (OKM). They may limit the amount of output (see e.g. HKDF) or they may even include the size of the OKM in the calculation, in which case you have to know the size in advance.