Many UUIDs aren't secure either and can be trivially enumerated. A better approach might be a long number generated using a secure random number generator and converted to a BASE-64 string.
Relying ONLY on obscurity is a failure.
EDIT: I'm mostly kidding.
If you know the hash, you likely already know the file.
Cryptographic hashes aren't random by nature.
Edit: even if they aren't PDFs, you can feed the content to the hash function.
With a hash it’s more expensive to compute the ID, but you get advantages such as content-addressability, data integrity without trust, and easily mergeable databases. It’s a good amount of bang for not much more buck.
At the cost of leaking more metadata in the ID, by including a checksum/namespace, you can recognise a valid ID or determine the type of object it refers to without fetching anything from storage, mitigating some DOS attacks.
IDs are a subtle thing, and in my experience, often overlooked as a design issue. A lot of times it ends up as something like “id integer primary key autoincrement” without any thought.
uuidv4