I don't know if that would be enough in real life for me. I know some organisations use two different domains (e.g. they did a transition but they don't want to turn off .org just in case something still uses it, the IT team forgot that Sam has two Outlook profiles, one is on .org).

And while pdfs can be attack vectors, they're not an especially strong one - it's not like running an exe with administrator privileges.

Comparatively giving a third party access to your emails should definitely raise flags.