From the discussion in the report, it looks like the website is serving HTML not a PDF. (The author seems to be getting an Anubis-like bot block page instead of the file they expected?) This seems like it has nothing to do with running JS embedded in a PDF if I understand what’s going on correctly.