Worth separating two things that keep getting mixed up in this thread. Opening a PDF locally means the renderer draws it on your machine. The file doesn’t leave. What actually ships your document off is an online converter or web tool you upload to. The line is local rendering versus upload, not browser versus dedicated app.
Sumatra is a good pick: it does not execute JavaScript in PDFs at all. For files you do not trust, look at Dangerzone. It converts a PDF into a flattened safe copy inside a container, so you never open the original at all.
I appreciate your reply!
It definitely seems like SumatraPDF is the best PDF reader available.
MuPDF has a big following but I’m thinking SumatraPDF + a firewall to prevent outgoing communication/telemetry is the best way to go?