> Is embedding executable code into a file a security risk?

Yes, which is why nobody uses PDFs.

which is why no sane pdf viewer implements executable features*

I mean I disable javascript embedded in pdf and feel like it would have been better to not have that feature. It would spare people from the invoice.pdf email attachment viruses because most people had assumed pdf isn't going to be as bad as an exe.