Did you know that PDF files are valid even if the first 3 bytes aren't "PDF"? A key to what makes a PDF "valid" is the second-to-last object in the PostScript structure, which points to the object that should be processed first (usually Page 1). Being almost at the end of the file, it makes it impossible to stream PDFs (portable my ass), also you can make a PDF that is also a PNG, HTML or almost whatever else if you change the extension. Even look different on different PDF readers!
And both are data security risks.