You're missing that the whole point here is that when read-eval is set to false then, precisely, you're making your intent very clear: you do NOT want to execut

You're missing that the whole point here is that when read-eval is set to false then, precisely, you're making your intent very clear: you do NOT want to execute code you didn't write. The problem is that there's a hole due to Java constructors being called (even when read-eval is set to false).