One of the most common misconceptions about Java security holes is that they are all simple implementation errors and that the specification has been sound and complete since day one. Threads in the newsgroup comp.lang.java.security and other newsgroups often repeat this fallacy as people attempt to trivialize Java's security holes. Sometimes the specification is just plain wrong and must be changed. As an example, consider how the Java specification for class loading has evolved. Often it is hard to determine whether a security hole is an implementation problem or a specification problem.
Specifications are notoriously vague.
In the end, the holes are fixed, regardless of whether they are implementation bugs or design-level problems. This leads to a more robust system. If Java stood still long enough, you would think all the holes would be discovered and fixed. But Java is far from still. With every major JDK release, the Java source code has doubled in size.