There is a toggle switch for the entire Java environment. In both Netscape Navigator and Internet Explorer, Java is enabled by default. The two browsers' security policies are, at the present time, very similar. Both are somewhat strict. Applets cannot open a client-side network connection to any machine other than the applet's origin host.
Applets can read only nine system properties.
Applets are not permitted to read any other system properties. There is no reason that all future browser vendors will choose to implement similar security policies. That two major vendors now do so is probably an artifact of Java's short history. Once browsers begin to implement different policies, security issues will become more complex. We can see a split among vendors happening already with the 4.x versions of Netscape Navigator and Internet Explorer.