So how bad of a publicity hit has HBGary taken with the Anonymous-breach? Am I paranoid for not immediately wanting to download and open PDFs from their site?

I don't understand the purpose of this report, it's just Process Monitor dumps and log files of rootkits being executed directly. No analysis is done, save a bit of ranting on the readme files provided by these rootkits. Is this information actually useful to anyone? It's trivial to recollect it yourself with Process Monitor

Recently, I think we've learnt that HBGary.* aren't actually very good at anything, no?

I think you need to take a look at this: http://news.ycombinator.com/item?id=2237789