I don't believe it's a risk, since you're not injecting arbitrary remote code into a document, you're more overlaying on top of it. Even if the reader wants to execute code, then it will, that's how you have a reader to begin with. As long as it's not the PDF itself (source document) deciding to execute inline code, you should be fine.

What does it matter if it's displayed in the document or in an overlay window or if it's saved in the document or not? That code could try to do anything; many PDF readers have a security option to prevent opening any remote documents or links.

Why do you think there is remote code execution? Without being familiar with that code (or evince code, which does the same thing) I can almost guarantee there is no such thing (what even would they be executing and why?).

How is the remote reference rendered, other than by executing a renderer for that format in a window? Renderers for web pages, for example, are very powerful platforms with a long history of security issues.

The reference being discussed seems to be another part of the same pdf.

I think you've misunderstood the feature. It shows an overlay window of another part of the same PDF you're already in. It doesn't open another PDF or a website or anything, it's just a small preview of another page essentially. You could just as easily scroll to where the reference is placed in the PDF, but this lets you quickly preview the section without actually leaving your position in the document.

I did misunderstand; you are correct. Thanks for explaining it.

And that is indeed very useful!