A public PDF can return X-Robots-Tag: noindex to request exclusion from search. That does not remove direct links or download access. Private material needs separate controls such as authentication.
Google must be able to recrawl the file to read the header. Blocking it in robots.txt can prevent that, and processing changes in search takes time.
An Apache example is Header set X-Robots-Tag "noindex", without a colon after the header name. Nginx uses directives such as add_header X-Robots-Tag "noindex"; in an appropriate server or location configuration and does not read .htaccess. Limit the scope and inspect actual responses.
