See #40398 (comment 2733987)
Specifically:
1674942 - Ok, so we need to add controlling the pdfjs.enableScripting pref to our Security Level logic. See this thread with response from Giorgio (the No-Script guy)
pdfjs.enableScripting