Drupal can do all these things.
Multi Step Approval Workflows with reassignments
There is the Workbench moderation module, but also now in Drupal core as of 8.4, the Content moderation system is available. You might need to do some research on how content review might be assigned to a specific user.
PDF files in the media library requires authentication to view/download - Does drupal have any security features that does not allow anonymous access to media files?
Yes, Drupal has a private file system available in core. You need to set this up when you are setting up the file fields initially, because converting from a public to private file system is a bit of a messy process (I literally just did it a couple months ago for a project). It you can store files in a directory outside of your webroot, and the user will request a path like /file/system/1234, and all appropriate access checks are made. You might need to set up some additional permissions to have these access checks respect things like "groups" or any other access rules that you want to implement.
Does Drupal support Roles, User Groups and security groups? We are looking to restrict users from certain areas of the website and CMS based on group and role permissions.
Yes! "Roles" are available out of the box in Drupal. You can define as many roles as you like, and apply permissions to each role.
There is a module called "Organic Groups" which provides the group functionality. You can restrict content access to group members as well. You can even define roles within a group, so different users can manage the group.
