Different layers of abstraction. JavaScript embedded in a PDF probably turns up as a string after being parsed. It doesn't necessarily get eval'ed. It's turtles all the way down, until you say no.