I believe those exploits are Java applets breaking out of the browser-plugin sandbox, which is designed to limit application access to even simple things like f

I believe those exploits are Java applets breaking out of the browser-plugin sandbox, which is designed to limit application access to even simple things like files and class loading. To be clear, these aren't strictly JVM vulnerabilities, and more plugin security-model vulnerabilities. Java "desktop" applications don't have such a sandbox and thus they already have access to things that the vulnerabilities enable (such as manipulating system properties). Really, we ought to treat Java desktop apps no differently than native binaries, bounded by the the OS' security model.