It is of course smart to use caution when downloading anything from an unauthenticated source, but this has become a pretty minimal problem the last few years.

It is of course smart to use caution when downloading anything from an unauthenticated source, but this has become a pretty minimal problem the last few years. AV heuristics and OS security features today are miles better than 5-10 years ago, and services like VirusTotal significantly reduce the amount of time a novel repacking of an old exploit can fly under the radar. Also in the case of a pdf vulnerability, the attacker would have to guess the right version combination of OS and pdf reader (or browser), reducing the percentage of downloads that would result in successful exploitation. This combination of factors seems to have made this tactic increasingly ineffective, so people have largely stopped trying it.