So someone can upload a PDF and link to it externally? That's a REALLY dumb design. ANYTHING like that WILL be exploited.

I've been doing web stuff since 1996, and while for professional projects I take security seriously, over the years I've put stuff up - largely "security by obscurity"... it usually flies under the radar, but not always. I remember also somewhere around 2010-2015 I installed a URL shortener so I could create private short URLs. By default, you didn't have to log in to create one, which was convenient. And even though only I used it in places that wouldn't get much attention, it still got found and abused.

Anything widespread or with obvious flaws WILL get compromised and abused. It's a hard lesson to learn, but there's absolutely zero excuse for someone providing services to multiple government agencies to have an open system like that. That's embarassing for them.