You can easily embed arbitrary javascript into any PDF, and you can obfuscate it pretty well enough to get past most endpoint security tools on the market.
That JS would be sandboxed similar to in browsers, so you'd still need an exploit to break out of that.
Not too tough, if you're a state backed group. Just buy one.
The going price for Adobe PDF RCE zero-days is $80,000
Is there a good no-nonsense way to clean PDFs of possible threats? Hunting around I see mentions of converting PDF->Postscript->PDF to remove junk, but I also see mentions that Postscript is its own security mess.
Your only option is to disable all of those fancy features. That config only lasts until someone needs to file a form with the government though.
You don't even need JS in a PDF. PostScript remains a Turing Complete language on its own.