True, and no one forced them to go it alone on Java. In fact, given that Apple's Java releases have historically run about a year behind everyone else's, I think most Java developers wish they hadn't.
Oracle put out a fix for this in February, and Apple didn't apply it to their own Java stack until they had a global PR problem. This could have been so easily avoided.
Head aches like, for example, powering the back end of millions of internet services, including, probably, your bank's internet banking system and loads of other services you rely on every day. Yep, what a pain Java is...
How was Apple meant to know about it before it was used for bad stuff. If Apple could know about these risks they would have a flawless operating system from the get go. Think about that for a minute.