Every major browser had put Java applets behind at least a click-to-play safeguard long before that time. I strongly suspect that the security arguments were a

Every major browser had put Java applets behind at least a click-to-play safeguard long before that time. I strongly suspect that the security arguments were always more of a convenient smokescreen than an honest concern. Browser developers wanted to drop Java applets because they wanted to dump some legacy plug-in infrastructure that was painful to maintain, and their management probably viewed support for old and unprofitable technologies as an acceptable loss to achieve that goal.