Why does the flaw not affect "servers or standalone Java desktop applications" (according to these release notes)?

What if either of those are running applications that allow sandboxed downloadable plugins from the internet or otherwise rely on security managers to safely run untrusted code?