Sure, the Java VM has seen many security exploits.

However, Java does avoid memory corruption errors which are sadly easy to create in C and C++. We see exploits of such things all the time. It does make sense to use a language like Java or Rust (or C# or JavaScript - basically, any modern sandboxed language) for that reason.

But yes, Java specifically has seen plenty of exploits, and that is a cause for concern.