But the viewer does matter. If I view using pdf.js, then not only does the "format" need to be unsecure (whatever that means), but it would require a browser v

But the viewer does matter. If I view using pdf.js, then not only does the "format" need to be unsecure (whatever that means), but it would require a browser vulnerability that's exploitable through javascript. At which point why go through the charade of a PDF at all?