The PDF inspector does multiple checks, which include:

• Looking for Javascripts
• Looks for URLs with tricks
• URLs with blacklisted TLDs
• Blacklisted URLs on the Internet

This is the reason why adding a TLD invokes this rule. However, it would also invoke if a blacklisted URL is encountered. Many URLs do not get blacklisted on the Internet right away. It is possible the message will get caught as spam if you run the same email through the simulator after some time.