Thank you for your response. I trust your judgement !!
So let me just add two remarks:
When I read A comparison between the old and new pdf viewer from last August, the first line seemed to say that "The old pdf viewer that joplin uses is being replaced by a new custom built one". That is why I thought it was not coming from Google or likes.
The second statement is also something I had not expected. Adobe seems to think that there are vulnerabilities, please see here : https://www.adobe.com/acrobat/resources/can-pdfs-contain-viruses.html
When you scroll down a little, you'll see that their recomm is .... to use a trusted reader (they mean Adobe reader, but the statement remains).