The article acknowledges that the so-called &quot;IPE rules&quot; only apply to small subset of libraries. (They don&#x27;t even apply to applets&#x2F;servlets because the libraries which run these things are supposed to handle the isolation here.)<p>IMO the gist of the article is this:<p>1. We came in believing that Java is more secure than C.<p>2. So we thought that Java would require fewer secure coding rules.<p>3. But it turns out Java has more! What does this mean? Was assumption (1) wrong or is there something else going on?<p>4. Analysis follows.<p>5. Our assumption was right, it&#x27;s just that Java has more stuff than C.<p>IOW, the point of the article was to refute the strawman, &quot;Java has more secure coding rules than C, hence it&#x27;s harder to write secure Java code than secure C code.&quot;<p>I&#x27;m not sure what you expected the article to say but just asserting &quot;Java is more secure than C&quot; is useless because you just end up preaching to the choir.