I've always operated under the assumption that nothing in a PDF is secure, and that the only safe way to redact something from one is to print it and rescan it. Convince me otherwise?
You get a PNGish version, which you redact and combine back to PDF