I don't think the Java Sandbox has had significantly more security holes than other similar sandboxes (eg, Flash).

Most of these vulnerabilities are only applicable to environments which are required to run untrusted code.