Yes and no. Whatever prints the PDF has to be able to run the JS payload. In the case of a physical printer, it's usually set up so there's [redacted] instead

Yes and no. Whatever prints the PDF has to be able to run the JS payload. In the case of a physical printer, it's usually set up so there's [redacted] instead of blankness (that the JS replaces), so you get redacted images and paragraphs. In the case of software printing to a static PDF which you can then print, the JS payload is generally set up to embed a series of rather obvious markers so that if the static copy is ever publicly revealed, they can go after you (DRM is easy when you only have a dozen customers in the entire world), but most PDF software that supports JS also supports JS disabling printing features so that little disincentive is unnecessary.