Its been waaaay too easy for devs to abuse the certificate model in Java. I have to care for nearly a hundred desktops and notebooks that access a portal for a car manufacturer that up until recently was owned in part by the GovernMent. Every interaction we have with this manufacturer occurs through this portal. Java is used extensively, and in my opinion needlessly, throughout. And not just any Java - only Java 6 update 39. Part of that is due to the lackadaisical cert signing allowances Sun/Oracle permitted. To do some diagnostics on a vehicle, a total of 5 certs have to be permitted - 3 of which are self-signed by third party devs. All on machines that access the internet for a dozen other things as well.
To be honest, its basically just lazy devs. Its not like they're targeting multiple environments - they're not, just Win 7. A lot of my gripe could be solved by consolidating certs and using a trusted CA for signing. At least then, I might be able to utilize the latest Java updates - but then that leads to a whole other issue: "sponsored" ad-ons in the update apps.....