One issue to implement TCO is that the "security model"/circus of Java is based on the stack frames, so you can not remove stack frames without getting into trouble.

The security manager has to be removed first [1]

[1] https://openjdk.java.net/jeps/411