My point is rather that I am vigilant enough to check the actual extension of the file when I know it comes from a dodgy source (and to distrust the defaults in the first place). But what about a non technical user to who if the OS says it's a PDF, has the icon of a PDF, then it must be a PDF.