They actually have a very similar proposal in the draft already:

    The sun.reflect.ReflectionFactory class only supports deserialization of objects whose classes implement java.io.Serializable

That is, you'll still be able to mutate final fields using the ReflectionFactory class, as long as that class inherits from Serializable