I don't think I've ever worked on a project that deserialized untrusted Java objects; where does this come up?

I suppose -- if you have a Java client for a (probably) EJB-based server; most of the cases where I imagine this sort of setup are with internal-only solutions, though, which mitigates the risk somewhat (but obv. it would still need to be corrected).

I've read about banks in some countries still commonly using Java applets for site access -- that could be a seriously-dangerous attack vector.