One of my previous employers, which happens to be exceedingly risk averse, switched to OpenJDK (and away from Oracle) for just this reason. Generally speaking, if someone is sufficiently paranoid, it doesn't matter which JVM they are using as their systems will be secured in other ways.