Yep, internal security is brittle. The initial pdf vector would be only the start of a long sequence of hacks, including social engineering. e.g. sending email from managers -- or slack messages as you mention.
Of course if you can access the software running the blockchain and get everyone to install an update, that works too