In an answer to another question, it was suggested that the shared secret derived from Diffie–Hellman key exchange could then be used directly as a one-time pad to encrypt a message (by XORing the message with the shared secret after writing everything in binary). This forms a simple hybrid cryptosystem.
User fgrieu writes in the comments that this has a flaw, saying:
"you may use its resulting shared secret as a one-time-pad": but this less than satisfactorily secure! If one simply XORs the message with the shared key and sends the whole result, then it is possible to recognize which of two messages was sent with probability sizeably better than random. There is a similar issue with ElGamal encryption. Problem is: in $\mathbb Z ^*_p$, Diffie–Hellman leaks the Legendre symbol of the shared key. That's one reason we stick a key derivation function on top of DH.
Recall that the Legendre symbol determines whether an element of a group is a quadratic residue.
Could we fix this by choosing an element $g$ that generates a large subgroup, all of whose elements are quadratic residues? Concretely, we could take $p= 2q + 1$ for a large prime $p$ and then find an element which generates the order $q$ subgroup.
Now, if Diffie–Hellman is done with this group element, any eavesdropper knows the lowest order bit of the shared secret. So I could just remove this bit and use all the higher order bits as the one-time pad, and no information about the shared secret leaks.
Is this scheme secure, assuming an eavesdropper can't break Diffie–Hellman? Even if the particular flaw fgrieu points out is fixed by this scheme, are there other compelling reasons to combine Diffie–Hellman with a key derivation function?
The Wikipedia page for Diffie–Hellman notes that IKEv2 chooses the public group element this way. However, they do not say whether a further key derivation function is applied.