If you're running defaults then you're already negligent. Not because defaults are necessarily bad (secure defaults ftw). But because you can always do better by tailoring your systems to your specific situation.

My point is rather that I am vigilant enough to check the actual extension of the file when I know it comes from a dodgy source (and to distrust the defaults in the first place). But what about a non technical user to who if the OS says it's a PDF, has the icon of a PDF, then it must be a PDF.