I don't think Apple's PDF renderer supports e.g. running JS, you'd need real Acrobat for that. Or are you talking about something else?
> they support decoding images which themselves have their own custom compressors that are also basically code themselves.
But this is fundamentally true for anything that displays images, right? Or are the PDF formats particularly bad for some reason?
Most people have some understanding that shady websites can give you malware, a drive-by exploit is pretty rare but it's good that most people think just visiting a site could infect your computer. But a PDF is just a document, right? Just thinking that a PDF is just words on a page is exactly why it's such an insidious threat. Or they'll get a PDF as an email attachment, see that it's not an exe or something weird, and open it because they think a document is safe.