The check/uncheck doesn’t change things for an Admin, but for a regular user, it works as intended.
This works for me. Nothing to see here.
Does the Scan check for javascript calls in uploaded pdf files or executable code that can run when a pdf is opened.