Firefox's sandboxing incomplete or nonexistent (e.g. GPU process is not sandboxed on Linux).
You could also disable Firefox's built-in PDF viewer and instead use an external PDF viewer that doesn't even support Javascript.
You misunderstand the argument the parent comment makes. It's not about Javscript in PDFs.
Not all PDF vulnerabilities involve JS though.
Native PDF clients have had lots of security holes. In this case having the client written in JS means we can repurpose the battle hardened JS sandbox to also contain PDF exploits.