Only ever use java for one internal work app behind a firewall and it’s only enabled in the browser that I restrict for that one purpose. That one app is a must have but since it’s only ever used behind a firewall and that with a corporate app I feel fairly safe. Don’t use it in the wild and don’t think I ever will.
I only use it to access remote consoles in HP servers—also behind corporate firewalls.