Hi Kristen, obviously it depends on the confidentiality level here, and it should go without saying that anything on the internet that isn't password protected (and even that depnds on the technology behind the password protection) is available if the wrong people want to get their hands on it.
If it's super secure I would suggest an FTP where someone needs to login to download.
If it's just that you don't want it available to others who aren't receiving the email, I'd just ensure that the pdf doesn't have an easily guessable URL, and it should be alright.