Except that it doesn't. The infections will bypass the firewall, coming in on an already allowed vector (like IE or Firefox or Outlook) and then disable the firewall or go outbound on some allowed ...
Acquiring the Java platform wasn't a top priority when Oracle purchased Sun Microsystems. There were plenty of ways for Oracle to completely ignore the Java Platform and still justify Sun's $7.4 ...