It's not the language that has holes - it's the java plug-in runtime. I agree that this gives java a bad rep but it really isn't related to the language all that much for normal non-plug-in usage.

Writing good sandboxes can be hard. Web browsers are pretty good at it but unlike java - they dont also have to support unsandboxed code running on the same VM so that makes things considerably easier.