What I mean by class loading being bad isn’t that it’s bad that you can load a new class, but that it’s possible to pass a string into an api and have that api vend you a class. That’s bad even if it’s a class that exists already and doesn’t need to be newly loaded.

I think unchecked serialization is bad because it leads to that “given a string you get an instance of the class named by it” problem.