So it's a good thing you're propagating partial truths then, right?

The JVM isn't easy to beat for software that's more complicated than "Hello World". Sure you can beat it, but you're going to have to work very, very hard.

The security flaws exist in the area few people care about (and shouldn't even really be installed any more) -- the sandboxing and web start code.

Did you include gcc and friends in your "too big" calculations? Hard to program without them.