In terms of the IND-CPA properties, the pairing can also be applied to create non-trivial bilinear map $\mathbb G_2\times\mathbb G_2\to\mathbb G_T$ to that the decisional Diffie-Hellman problem is easy in $\mathbb G_2$. Thus $\mathbb G_2$ should not be used for El Gamal constructions where ciphertext indistinguishability is required. Applying the pairing to $\mathbb G_1\times\mathbb G_1$ gives a trivial map, but one must be careful to use only elements of prime order $\ell$. The pairing can be extended to $(h\ell)$th roots of unity for a cofactor $h$ of moderate size and for the BLS construction, there is a distortion map from the order $h$ subgroup of the small field to the order $h$ subgroup of the large field and so DDH is solvable with advantage when that subgroup is used.
The main reason why BLS12-381 groups are not used is likely to be a question of efficiency. The security of private key recovery for EL Gamal in both groups is believed to be 126-bits, using the XTNFS attack of Barbulescu et al. The same/better level of security is attained by the NIST-P256 and Curve 25519, but the operands for these curves are over 30% smaller and so require less computation and bandwidth.
