I think you missed the 'final' keyword from @sreque comment. As long as at least one of the fields of the Thing is final, instances of it get published safely (https://shipilev.net/blog/2014/safe-public-construction/)