It hasn't (although some alternative VMs didn't implement it) but Java applets basically died and now I think people don't really benefit from the bytecode verifier, except arguably in debugging their JVM-targeted compilers. (I say "arguably" because generating valid JVM bytecode sometimes requires bending over backwards a bit, so your compiler would probably be simpler if it didn't have to deal with the verifier.)

Many holes have been found in the verifier over the years. More probably remain, although at this point JIT compiler bugs may be a more significant attack surface.