There's also HashMap randomization, that was introduced in JDK 9 to make certain kinds of attacks more difficult to perform.

The moral of the story should be: don't lean on undefined behavior.

If you care about iteration order, that's why there's a LinkedHashMap in the API.