It almost sounds like Oracle managed to shoo away all good folks from the JVM team and all they are left with is a bunch of B players. I dont remember it being this bad.
That they've inherited a huge, complex codebase is unfortunate.
I think any program or VM, Ruby, Flash, Python, whatever would end up with the same number of security holes if it had the user base to attract attention from hackers.
But, it bears mentioning that Ruby and Python aren't a mainstream part of browsers. And Flash (under Adobe) has actually done some pretty impressive stuff recently with regard to sandboxing.