Even then there might be some remote management exploits which would work on turned off machines, so unplug the cables aswell.
There is also more ways then just turning off your machine. Its needlessly oversimplifying complex topics. Topics that are very interesting and have severe implications. Especially if we are talking about state level espionage.
So in short, no you are wrong. PDF exploits are still a thing. You made unjustified assumptions.
Reading my post it sounds confrontational. Thats not my intent.
The best way to reduce the number of bugs (exploits) in a system is to get rid of it.
Since you've brought up state level espionage, this might be the reason why states are run by hordes of bureocrats processing physical paperwork (this is an oversimplification of course).
