I didn't know they could embed javascript. That's horrifying.

I don’t think any of that is possible with the JavaScript APIs exposed (if any) by common PDF readers. I’ve tried to do useful things with JavaScript in a PDF and failed utterly. https://stackoverflow.com/questions/32597283/can-javascript-...

Tracking is one possible problem. The other is, that JavaScript can modify the document itself, so a part of a contract for example might print out differently depending on conditions.

That's why PDF/A for archiving was created which disallows various components, cf. https://en.wikipedia.org/wiki/PDF%2FA

Fortunately many PDF viewers don't run them.