Java comes with its own problems, especially in enterprise environments where you might be pinned to a single version. There are plenty of insecure JVMs out there that can't be upgraded on both servers and clients, mainly to ensure compatibility or meet support requirements.