I’d love to hear more about why PDFs might be riskier than, say, azw or epub. Is it something inherent in the pdf format, or are pdfs so comparatively common they’re a more attractive vector of attack?
Arbitrary files can be embedded inside a PDF (by design), such as malicious code files. Many PDF readers have security issues allowing for PDFs to automatically allow for code execution of those embedded files, or prompt the user for a click to execute the files.
Just search for something like “executable code inside PDF” and browse through the many results of examples, issues, and tutorials to see.
I believe pdfs can load remote images, which pings a server.
There are other reasons, I haven't got sufficient knowledge.
Some pdf readers will offer a sandboxed mode improving security. I think zathura has this for instance.
I haven't seen anything except the safe pdfs, epub etc formats. Similarly to movies there shouldn't be a risk to downloading malware unless you execute the files (e.g. double click).
I've had one children's book that Gmail flagged as a virus when I tried to send it to my nieces eBook Reader via Mail, so I deleted that and just got another instead. I didn't bother opening the book because I didn't not care much so it might just have been a false positive. I don't remember which format.
It was the only one out of about 200 books that got flagged.