For those not in the know… PDF is a particular set of conventions for delivering peograms written in a programming language called “Postscript”, and like all programs they can be hijacked to trigger unexpected results, including the delivery of software viruses. And yes, while those programs run in “sandboxes” that are supposed to prevent propagation of harm, such environments can fall in that purpose due to creative triggering of imperfections in the sandbox code by the “contained” Postscript code.

Hence, quotes are used to convey lack of trust in the claim of safety.