It's not impossible there'd be something interesting there... but Java is a more likely attack vector simply because part of its normal functionality is to exec

It's not impossible there'd be something interesting there... but Java is a more likely attack vector simply because part of its normal functionality is to execute code downloaded from the internet. Before this recent patch, that code would be executed without even prompting the user. Sure, there's a sandbox, but (as we know) sometimes a sandbox has cracks, particularly when the runtime is designed to let code to only enforce the sandbox for some code it runs, not all. (Compare to JavaScript execution, which also runs downloaded code without prompting, but JS in the browser is always in the sandbox -- there are things it simply can't do, vs. Java's "this is do-able but not for you".