I guarantee Java would be vulnerable to the same category of errors even without runtime class loaders. Java puts a lot of emphasis on dependency injection, and has done this for a fairly long time. This takes the form of having classes pull dependencies themselves through some central registry over explicit construction.

It's arguably a symptom of a larger problem the ecosystem's sheer size.

As does dynamic linking, which is perfectly equivalent.

Not only a feature but an idiom.

Most languages' built-in serialization has similar issues, e.g. Python pickle.

"Our language is harder to use than X, so it's safer because no-one will try to do certain things with it" is hardly a compelling defence.

Another one that never saw the heyday of enterprise C code.

And if you disconnect your computer from the internet then it's safe from most remote attacks.

No, JNDI is an API for accessing remote code. It stands for Java Naming and Directory Interface. Not supporting LDAP, the most common remote directory, would have been a flaw.

The flaw was in log4j's use of the library which allowed remotely connecting and executing code by default based on connection strings which were possibly user-entered.