Because most alternative PDF renderers have been worse? Charlie Miller did an analysis once, fuzzing various engines, and Adobe's actually came out on top. (Combine this then with personal experience tangentially gained during JailbreakMe 2.0 and 3.0, and I now refuse to allow Apple's PDF renderer to ever open a file on my system, and always make certain to have Adobe Reader installed on my Macs.)
There's a difference between theoretical and practical security, though. On Windows everyone targets Adobe's products, because everyone uses them, thus they present the biggest attack surface. So while e.g. Acrobat may be more secure in theory, in practice it's the least secure of all.
If OS X ships with a built-in PDF viewer then it probably presents the bigger attack surface, thus could be less secure than Adobe's products in that case. But as an individual (non-enterprise) user, statistically you'd still be better off with some niche third-party offering.
Most of the "niche" renderers use the same codebase (or at best only rely on large common libraries like FreeType); the JailbreakMe 2/3 exploits, for example, were able to affect almost all of them (its payload simply assumed it was trapped in MobileSafari and wanted root on an iPhone, but on systems without codesign I believe it could have affected just about everyone fairly generally). The thing that Adobe has going for it is that when there is a bug, they tend to fix it, they fix it correctly (JailbreakMe 3 shouldn't have been possible), and the fix is pushed quickly to users via automatic update prompts.
> Charlie Miller did an analysis once, fuzzing various engines, and Adobe's actually came out on top
The CanSecWest slides I found had him fuzzing standalone "PDF applications". This whole problem is because of handing random stuff from the internet to third party native code! Nowadays the browsers are in a class of their own wrt security.
So use the PDF readers built into browsers, Chrome has one tended to by their security ninjas and Firefox has one running in their battle-hardened Javascript sandbox.
