Literally to make it able to be serialized by Java. There are many legitimate applications for Java serialization which do not suffer security concerns. You sh

Literally to make it able to be serialized by Java. There are many legitimate applications for Java serialization which do not suffer security concerns. You should never expose serialization for public APIs but that leaves private APIs and private storage systems (think message queues, disk caches, internal RPC, etc). For private serialization, Java serialization has many advantages over something like JSON. You can serialize object graphs without concern for cycles. The contract is simple (it serializes fields, as opposed to dealing with weird bean naming conventions). It handles types and structures automatically. `transient` is built into the language. Polymorphism just works. We use it heavily for ephemeral storage. It's great.