I'd actually consider browser pdf viewers safer than a standalone native app. Firefox uses pdfjs, a pure javascript pdf implementation running inside a battle-tested browser javascript sandbox. No unsafe native pdf code with countless holes.
Incorrect, that was abandoned and pdf.js is very-much what's being used.
No it does not, Firefox still uses PDF.js. This is extremely easy to verify by just right clicking and hitting "Inspect Element" on any PDF opened in Firefox (and also you can then just load PDF.js into Chrome on a page, load a pdf into that, and verify the same behavior.)