Is the fact that the URL is hard to guess protection enough (you don’t care if someone could possibly share the link with someone and/or access it after their subscription ended?). If that’s important and you don’t want to use S3 and Secure Media Uploads and you’re self-hosted then I have a $500 solution with some minor caveats.
If you just want the PDF to show up in the post, check out Inline pdf previews