As I mentioned in another comment (and I think others have mentioned this as well), browser PDF viewers implement a subset of PDF features, and notably they won't support things like forms (I think?) or signatures. So I can imagine that attacker tricked the user into opening the PDF with separate software by saying something along the lines of "you need Adobe Reader to sign this document" (and I don't think DocuSign is ubiquitous enough that users will second guess that).

I think both Firefox and Chrome support forms now, although I know that there are other interactive features that they don't support. But yeah, I can see the attacker convincing the victim to use Adobe regardless.