This is ridiculous. Flash is a hack on a cludge, 20+ years of legacy code, fiddling with raw chunks of memory for speed and with no type system enforcement. You couldn't do animation or FMV with javascript in the past, these were features only recently supported by browser or standards. The only spec for flash is the implementation.

Google went to significant efforts to sandbox it, but that still caused problems, not least with additional complexity. As for this idea that NPAPI should continue to live... Yes "security" is a problem with NPAPI.

As for Google fixing Java... You may have heard of Oracle? And the fact that they are .... not nice?