If people find having the risk is acceptable, they may use apt pinning to force the older packages to remain installed. Our users are expecting that the normal

If people find having the risk is acceptable, they may use apt pinning to force the older packages to remain installed. Our users are expecting that the normal software update process ensures that software they are using is maintained in a secure state with timely security updates. To leave Java at a known vulnerable version would be irresponsible, and most likely not what our users are expecting.