Consequentially, they're all as bad as each other.
"More secure" is subjective i.e. it's more secure to us public but who the hell knows there aren't 100 zero day's out there in the wild changing hands for thousands of dollars.
The problem doesn't exist because people just aren't paying attention to security, or because the entire architecture of the web is flawed. The problem exists because it's a damn hard problem to deliver arbitrary executable code to clients on demand and let them run it and do useful things with it without compromising security and privacy. The browser vendors have really stepped it up in the last few years, and it takes a very narrow view of the web to see otherwise.
Capturing the mouse position is perhaps legitimate for an "application" but not necessarily a "document". The web conveniently has turned from an information medium into a catch all for pretty much every hack that is imaginable. That's where it's all fallen over. "documents" are now "applications". This has lead to all of the crocks of shit out there. Office VBA and programmable documents are in a similar state.
I firmly believe we need to make the distinction between a document and an application and have appropriate sandboxes and/or virtualization for each.
Documents deliver information.
Applications deliver means of interaction.
That neatly assumes that documents are data and not code.
The issue you state is a property of three things:
1. The underlying language/vm allows code and data to be interchanged (c++).
2. The underlying vm allows memory to be overwritten and buffer lengths to be exceeded to start with.
3. Pdf allows arbitrary code to execute on your computer.
My point demonstrated.
Embedded JavaScript is another matter, but it's not needed to be executed for parsing the document.
_____________
¹ This gives rise to interesting applications, e.g. you can remove pages or images by just removing a link in the PDF. Yet the object would then still be there. There are some PDFs out there where sensitive information is buried in unlinked objects that still exist within the file. But that's obviously besides the point.
[1]: http://stackoverflow.com/questions/9219807/using-javascript-...
The thing is we had all the things you say are great, and in spite of this we have created the browser as an application environment. Evidently people don't want a document web.
Adobe PDF and Word are evidence that document readers attempt to become web browsers with time anyway.
You can go back to 1993 and turn your web application platform (a.k.a browser) into simple document reader by disabling javascript (+ plugins, whoever keeps them enabled anyway). Good luck with that.