> every Java project is potentially exposed to this kind of thing

Many Java projects, but not all. Class-loading permissions in a Java program are subject to the security-manager policy for the program; class loading can be moderated or even fully disabled (once the main program is loaded, of course).

The default is to allow anything to be loaded, however.