If she clicks yes to all popups, then Java is a risk to her even with all security bugs patched, because I can request permission to get out of the sandbox with

If she clicks yes to all popups, then Java is a risk to her even with all security bugs patched, because I can request permission to get out of the sandbox with a signed applet, and if she approves I can do whatever I like with her computer. Of course, if she's opening odd-looking links in her email anyway (which is how she'd get to a site that might include a dangerous applet) there are likely all kinds of attack vectors that she's vulnerable to.