Hey I have a real world example, it's not a problem with the JVM but with the way JVM interop would work for a .NET shop. A company I was working at was using

Hey I have a real world example, it's not a problem with the JVM but with the way JVM interop would work for a .NET shop. A company I was working at was using a java library to do one specific thing related to file uploads, despite all their code being .NET. The library became a bit of a black box and no one bothered to keep up with updating it as it was essentially a binary blob that sit outside the normal update mechanisms (visual studio references) Turns out the library had patched a RCE vulnerability a while back, spent a fun afternoon making a PoC exploit for it (tricky because we had some other file validation in place) to win the unofficial office competition to find a security hole in our product. I would agree with your point in general, but the moral of the story is that adding complexity is not good considering most people are too lazy/incompetent to understand the full implication of something like "I'll just use a third party binary / library here" to their ongoing maintenance.