The two concerns that IT departments have with flash drives are:
- They are vectors of infection.
- They can be used to exfiltrate data from the company's secure network.
Regarding infection, the size of the drive is unimportant. Either it has bad data on it or it doesn't. If you are talking about USB-specific attacks such as BadUSB, then all that matters is that the device uses a USB connector - it doesn't even need to be a drive. Keyboards, mice, and even USB cables can all be infected.
As far as taking data outside of the company, a smaller flash drive is perhaps easier to physically hide, but other than that, there is no difference.
My suspicion is that your IT department has implemented a set of policies that are a compromise between the security they want and the convenience their users want. I cannot say if the IT department did this intentionally or not.