There is a strange dynamic between the threat actors who conduct these breaches and researchers.
When not used for extortion and for "status" in the hacking community, they share them with researchers (commonly HIBP) to warn people about a site's security and so that site is forced to fix things.
Many malware hijack search settings. However, very few hijack default browsers themselves these days. In the past (10 years ago) it was much more common.
Furthermore, I don't know of many malware that touch the .PDF file extension associations, and there are plenty of other associations that would be better to hijack.
Feels more like a sloppy fix to comply with EU's DMA.