I’d love to hear more about why PDFs might be riskier than, say, azw or epub. Is it something inherent in the pdf format, or are pdfs so comparatively common they’re a more attractive vector of attack?
Arbitrary files can be embedded inside a PDF (by design), such as malicious code files. Many PDF readers have security issues allowing for PDFs to automatically allow for code execution of those embedded files, or prompt the user for a click to execute the files.
Just search for something like “executable code inside PDF” and browse through the many results of examples, issues, and tutorials to see.
I believe pdfs can load remote images, which pings a server.
There are other reasons, I haven't got sufficient knowledge.
Some pdf readers will offer a sandboxed mode improving security. I think zathura has this for instance.
I haven't seen anything except the safe pdfs, epub etc formats. Similarly to movies there shouldn't be a risk to downloading malware unless you execute the files (e.g. double click).