Assuming they have a zero day vulnerability in acrobat (or other PDF readers), they wouldn't risk losing it by uploading a file with an exploit, using their own

Assuming they have a zero day vulnerability in acrobat (or other PDF readers), they wouldn't risk losing it by uploading a file with an exploit, using their own name, and in a wide distribution. When the GCHQ wants to hack you, it won't be on GitHub. It will be a file served specifically to your computer, with content relevant specifically for you, from someone you trust and don't suspect.