You can turn JS off for Firefox’s PDF reader via about:config.
Chromium’s PDF viewer has a restricted subset of JS. There is also a way to turn off JS, since it respects the browser’s JS setting.
Also see PDF Reader That Is The Best For User Privacy? - #40 by sha123
If you want maximum security, you can use GrapheneOS’s PDFviewer on Android: https://play.google.com/store/apps/details?id=app.grapheneos.pdfviewer.play
Dangerzone is also an option.