It's not irrelevant. A rogue (automatically run) annotation processor will generate exploit code bundled into the build output artifact, which will then run on

It's not irrelevant. A rogue (automatically run) annotation processor will generate exploit code bundled into the build output artifact, which will then run on the production systems. Besides, annotation processor can attack the build system as well.