Although the article does not mention it explicitly, these recommndations are primarily aimed for applications running as untrusted applets in a browser. Trusted applets or applications using the normal system classpath (Java desktop applications or Java EE applications) can anyway use the Java reflection API to bypass most of those restrictions (by calling for instance "setAccessible").