Java has all the security logic INSIDE THE VM.

That's the big difference.