Zero websites automatically get JavaScript access from me, and many other savvy web users.
If PDFs are not subject to these same controls in Firefox, then this could be a security and privacy vulnerability.
Even if this weren't true, it would still be false that "all websites already use JavaScript".
Does the JS run in a true sandbox? Inside, outside, or beside the usual browser sandbox? Are network requests allowed? Filesystem access? Are granular permissions required/available?
I want to block JS in PDFs, by default, like I do in web pages.
I'd also be happy to hear that the JS runtime in PDFs is run in a tight document sandbox, operates only on a highly constrained DOM-equivalent, and has zero network or filesystem access. Seems reasonable.