Why do you think there is remote code execution? Without being familiar with that code (or evince code, which does the same thing) I can almost guarantee there is no such thing (what even would they be executing and why?).

How is the remote reference rendered, other than by executing a renderer for that format in a window? Renderers for web pages, for example, are very powerful platforms with a long history of security issues.

The reference being discussed seems to be another part of the same pdf.

I think you've misunderstood the feature. It shows an overlay window of another part of the same PDF you're already in. It doesn't open another PDF or a website or anything, it's just a small preview of another page essentially. You could just as easily scroll to where the reference is placed in the PDF, but this lets you quickly preview the section without actually leaving your position in the document.

I did misunderstand; you are correct. Thanks for explaining it.

And that is indeed very useful!