When people talk about Java being insecure, they're talking about the browser plug-in. Java apps themselves aren't inherently insecure, it's the browser plug-in that causes problems.

Citing security and market forces as primary factors, Oracle said it will drop support for the Java browser plug-in in JDK 9.