It's a historical fluke. Credit bureaus trace back to agencies that compiled third-party reports on the creditworthiness of business persons. So long as the information collected is accurate (and not defamatory), this type of activity is protected under the first amendment.
But then what happens if that information becomes inaccurate? (if your credit report shows credit events that aren't yours as a result of a fraud). Doesn't it become a form of defamation?
It's ridiculous, but no property management company wants to risk a fine when the cost of checking the OFAC SDN list is so small. I'm not sure if we ever saw a decline due to the OFAC list, so I could easily see it would take a long time for something that unusual to be straightened out.
See the first segment of this episode of the Backstory podcast for a retelling of how these early agencies worked: http://backstoryradio.org/shows/keeping-tabs-2016/