the mut is not part of the function's signature, even though it sort of looks like it is. There is no difference between fn save(mut self) and fn save(self) in terms of how you're allowed to call the function (because that analysis is done on the basis of the signature only); the only difference is in what you're allowed to do with self in the body of the function.
impl PDFDocument {
fn save(self) {
// (Different name because you can't shadow `self` specifically)
let mut self_ = self;
// ...
}
}
So (a) changing mutability when moving is a general thing and not a function call specific thing, and (b) the signature doesn't even actually tell you if the argument is modified in the body or not.