With HTML, I have to trust that some random entity does what they state in their privacy policy, and they regularly don't. Sure, I can disable JS, but then 95% of the web doesn't work anymore.
Other than that PDF is quite clearly a less accessible format.
Pretty sure a PDF opened in the browser can't run any JS, but not completely sure. So you're right: I don't really know it for a fact. Poor choice of words.
JavaScript is allowed, but not in PDF/A, which is what I use.
The PDF 2.0 spec is damnably not public.
If you only allow PDF, then 99.9999% of the web doesn't work anymore.
I'm all for getting sites to be static, but PDF doesn't fix that because the problem has never been the technology used to build the site.
(It looks like at least some PDF readers have provided support for automatically displaying external images, for example)
I often use Tor, although I'm pretty sure that even then, a good analytics lib can see it's me based on scroll behaviour, mouse movement, time of day, and of course what I browse.
But yeah, you make a good point.
You might not be a unique fingerprint, but at best you are part of a group of somewhere between 3 and 1000 similar users.
Not to be a downer, but when I webscraped I learned that big corporations can spend money to fingerprint you.