I've seen many an art project that eventually stops being updated and is used to serve up malware -- sometimes with a bonus expired or nonexistent cert.
It should never be a requirement to enable JS to download a binary file like a PDF.
If you're concerned about scraping, put in a robots dot txt and/or give it to an entity like Internet Archive to host.