The PDF spec even supports attachments in PDF files.
I recently had to add an embed feature to our pdf rendering, to allow users to embed other pdfs inside the one we generate for them. Since we use headless Chrome, I used pdfjs from mozilla to render the embedded pdf on screen before generating the pdf, so you can actually see and read the embedded pdf.
Works pretty well, but was wondering about this attachment feature of pdfs.
Since these pdfs end up in whatever and how old devices, I'd rather not risk it though.