Why is removing a legacy component which is effectively ignored and unusable by most modern applications an issue? SecurityManager is very fine-grained so you h

Why is removing a legacy component which is effectively ignored and unusable by most modern applications an issue? SecurityManager is very fine-grained so you have to spec out every file access by your application (including those of third party code you may or may not know about). Most server side Java deployments run without it so you're better off making sure the permissions of the server process are correct than customising the Java policy.