Network effect. Most documents are PDF. You would need at least backward compatibility, which would mean opening doors to the existing problem.
Re security, there are many pdf viewers, so the rewrites exist, and some of them do not have the js execution engine and all that jazz that opens up all sorts of potential exploits.