While PDFs can contain malware and for some reason people trust hosts with domain names more than bare IPs, the sole reason Firefox showed the warning was becau

While PDFs can contain malware and for some reason people trust hosts with domain names more than bare IPs, the sole reason Firefox showed the warning was because you attempted to download a file via HTTP from a HTTPS page - it had nothing to do with the file type or bare IP. The reason for that is browsers already have some methods of differentiating between HTTP and HTTPS when displaying web pages, but not for downloads. So folks at Mozilla decided to implement a feature that warns the user in this specific situation. Personally I disabled this feature (block_download_insecure in about:config) but for the majority of the population it might be a good thing.