True together with formType: "acroform" means a HYBRID form: pdf-lib fills the AcroForm
layer, but Acrobat renders the XFA layer, so the recipient sees a blank form with no error
raised anywhere. Callers should refuse or warn.
False means formType and hasXfa report what pdf-lib can see — nothing — not what the
document holds: pdf-lib does not decrypt, so a root object inside a ciphered object stream
leaves it with no catalog. pdf.js is the reader that can still answer.
Whether the document declares encryption. Encrypted PDFs often still fill and flatten (permission flags only), so this is a signal, not a verdict.
The layer we can fill. A hybrid LiveCycle form reports
acroformbecause that is the layer pdf-lib writes — check FormTypeDetection.hasXfa before trusting it.