async5

Shumway can be used as a runtime for those movies - the site owner just to need fallback to its HTML player. It plays common ActionScript 1/2/3 usages well.

Exactly!

Market share... and ignorance of users :)

There are not exploitable (at least not the same way). Firefox PDF viewer is a modification of PDF.js, so PDF.js code would run in the browser without a web server. The exploit might poke a hole in EMBED tag security of the web browser (and not in the PDF.js code itself). WP plugin shall be safe as any web application (unless it introduces similar security hole in its code, e.g. XSS).

For users that are opted in telemetry reporting, it can go up to 40M PDF views per browser version [1]

  [1] http://telemetry.mozilla.org/dist.html#!cumulative=0&end_date=2015-06-05&max_channel_version=beta%252F38&measure=PDF_VIEWER_USED&min_channel_version=nightly%252F38&product=Firefox&sanitize=1&start_date=2015-03-04&trim=1&use_submission_date=0

Original PDF - 1.0M, SVGs - 7.7M, gzip'ed SVGs - 1.7M. I think the latter is a preferable format for the web, so you are looking 70% increase for this types of documents, but bare in mind that you may send only certain pages.

Now you have alternative to not use PDF (viewer)?

Just a hint: "pdfjs.disabled" is hard switch off and it makes it harder to recover native PDF plugin viewing capability. Switching using Preferences/Options->Applications makes it easier. Try it and stop complaining that you don't have a choice :)

Except one does not provide protection from the patents.