I get equally confused anytime Microsoft Office gives the "Files from the internet may contain viruses." warning. How do you mess up a document editor so badly that the document can affect the computer? I know that the answer is Visual Basic, and I know that there are legacy reasons why it will never be removed, but holy cow, it is ridiculous.
It's not just VB. Any code in a program which parses any kind of data, including "passive" data like images, docs and even plain text, is vulnerable to bugs in it's own code. It's often not related to what the data is, but the way in which it is handled.
Please don't fall into the Dunning-Kruger[0] trap by assuming a straightforward task is also easy to perform. These things may very well be complex and include aspects that are not immediately obvious. And even if they don't, even simple code executing simple tasks can be vulnerable to bugs or flawed reasoning without the authors (or tooling) being stupid or naive.
Basically, regardless of VMs etc, parsing any kind of binary data is inherently dangerous. Old binary formats were bespoke, there weren't always standard libraries to read the headers etc, so everyone wrote their own, with their own bugs. A common attack vector was simply using invalid lengths on header fields, causing a stack or buffer overflow to fool the host into executing the binary data as code.
That's one of the reasons these days there's a tendency to use text-based representations like JSON, but of course anything size-sensitive such as images and movies is still generally binary.
What I really don't understand is Acrobat Reader. It has a "Protected View", which is the first WTF - .pdf-s are read-only, so there should be absolutely zero active code running anyways. What's the next, much bigger WTF WTF WTF is that you need to exit protected view to print the document.
How can the program read and render the document on screen, but not print it?! How is this even possible?
PDF can contain executable code (JavaScript to be exact), access remote URLs, and has several separate modes of display (which means that document rendered for printing is different than what you see on the screen).
PDF is an old complex format with a lot of features used in a lot of special cases that go light years beyond looking at a simple text file. It's the reason for all the issues, but keeping it useful as it is and magically waving away all issues is not really easy.
PDF is a very fancy wrapper around post-script (massive over-simplification). Post script is a Turing complete language. As such, PDF is essentially code.
