Take a look at the security record of both in browser plugin scenarios and get back to us on that...
While Java admittedly has a solid underlying core, the criticism is for the entire platform, which has some significant problems, some technical, some security, and many organizational.
I'll definitely admit that the browser plugin is a piece of crap which should be moved away from. Sadly, there's still a ways to go for that as a number of countries use them pretty extensively. (bank interfaces are brought up a lot on HN) And yes, organizationally they definitely have some problems. The JVM has still been making progress though, with new garbage collectors and project lambda.
That said, I'm not sure what technical problems you're referring to. The JVM seems to work quite well on all platforms, even if it can be kinda clunky to program in Java at times. (which is part of the reason I mentioned other languages) And yes, I know the JVM is slow to start. It isn't designed for small scripts. Use Python or something else for that.
Yes. And what's even worse is this: How many sites in common use actually need the Java browser plugin? And yet, if you are not careful, it will be enabled in your browser, thus increasing your vulnerability for no good reason.
If regular users were commonly aware of what browser plugins they actually need, and knew how to go through the list and disable the ones they actually didn't need, that would mitigate things somewhat.
While Java admittedly has a solid underlying core, the criticism is for the entire platform, which has some significant problems, some technical, some security, and many organizational.