Adobe Acrobat (Reader) opens PDFs from download locations in “Protected View” by default, which disables potentially dangerous dynamic features, and also by default opens all PDFs in a “Protected Mode” sandbox which restricts otherwise possible system access. You want to make sure that those are active. I believe that’s on Windows only, not sure what the implications are on other systems.

Without those restrictions, PDFs can execute embedded JavaScript on open, which can access and execute local files.