Possibly because a superclass or interface are marked, and it is inherited? The problem is that (excluding the new filtering mechanism) deserialization is unsco

Possibly because a superclass or interface are marked, and it is inherited? The problem is that (excluding the new filtering mechanism) deserialization is unscoped - any class in your code, a third party library, or the core VM is fair game in an attack.