We found, that also architecture wise (seperation of concern) it will be better to solve this on the webserver level.
In our caddy:
header *.pdf {
X-Robots-Tag "noindex, nofollow"
}
I also like it way better not to hijack sulu/symfony for this.
Update Feb/2020
Actually it turned out, that our webserver caddy is not as straight foreward as the above assumption. Caddy 2 can probably do it, but is not out jet.
We will investigate also a bit, weather we could upload pdf files to a specific folder instead of the dynamic delivery atm.