Yeah. This should have been a HUGE INCREDIBLY LOUD FLASHING RED WARNING SIGN when they implemented the code execution feature. Like, "wait what if the in-built jvm sandboxing isn't available" should have been among the first questions. And it isn't too terribly difficult to implement your own sandboxed interpreter if you don't have access to the SecurityManager.

Heck, SecurityManager has been basically a dead feature for ages. I'm stunned that JEB didn't start with a different solution.

Agreed, I would have expected this to fail shut and require some flag to function. Inconvenient, but in this case, I'd prefer to be inconvenienced and safe rather than conveniently owned.