Sure, PDF is a bit hairy. But you also can choose to not use Acrobat Reader. If you use e.g. Preview (macOS) or Evince (Linux) then I would wager that it’s not exactly trivial to get remote code execution. (Most probably possible though, but it would probably take some work.)

I think all clients are a bit questionable since it's such a complex format and because most clients are not written in safe languages. Although they're rarer, even Mac OS X's Preview.app has had CVEs.

Here's a tip: the safest way to open sketchy pdf is through PDF.js that's used in browsers as it relies on the same JS sandbox you use to browse net all day. Other than that - open documents in a VM (with reverting to the previous snapshot after viewing the file) or install Qubes where this is default behaviour.

> Somewhat paranoid there are zero days on libgen, etc.

Do you have an alternative to trusting them?