Because the_content doesn’t even process until the password has been successfully entered, you can add a shortcode that redirects the page, that shortcode will run only with good password. So, something like the following should work:
add_shortcode( 'pdf_redirect', function ( $atts ) {
$a = shortcode_atts( array(
'url' => '',
), $atts );
// instructions in case of misuse
if (empty($a['url']))
return "<pre>Please assign a destination for the PDF redirect, [pdf_redirect url="https://yourpdfurl..."]</pre>";
return "
<meta http-equiv='refresh' content="0; url={$a["url']}'>
<script>
window.location.href="https://wordpress.stackexchange.com/questions/288730/{$a["url']}';
</script>
<p>If your browser hasn't redirected you, please <a href="https://wordpress.stackexchange.com/questions/288730/{$a["url']}'>click here</a>.</p>";
} );
And then on your password protected page, the content is:
[pdf_redirect url="http://example.com/file.pdf"]
The meta refresh is bad coding standards, but all browsers support it and it works. The javascript is fallback redirect, and the html link is double-fallback. Now you could make the redirect happen before the document headers by tapping into a early hook like wp_loaded, seeing if the user has proper password with a function or two, and interpret the $post->post_content shortcodes yourself then properly redirecting with wp_redirect() – but the lazy way I’ve done works too.