What is the final word on Java for Mac?

I have been working with Java for the past 15 years and consider myself an expert. The biggest potential attack vector is with the Java plugin in the browser, not with having Java installed in principle on your computer and using it with programs that are installed and run on your local computer. Just in case, I also recommend you keep your Java up-to-date, just like other software. I assume you use some Java 8 version from Oracle, and not the very old 1.6 that Apple used to supply ages ago.

Realistically (real-world!), I would even go as far as to say, if you only visit at least somewhat reputable sites, the chances that you would come across a malicious Java applet are tiny. However, if you are concerned (e.g. you have other people like kids using the same computer), I strongly recommend you go into the Security Preferences in Safari and block Java for any websites. You can enable it for specific (reputable) websites that need it. While you're at it, make sure you also have Flash blocked (a far bigger security risk) for any web sites except explicitly enabled ones that need it.

 

If you can live without Flash, then you might as well remove it - as far as I have encountered, the main uses for Flash these days are:
a) Delivering videos - this seems to be diminishing as more and more sites switch to standard HTML5 delivered videos
b) Small games played inside the browser - this will realistically stay with us for quite some time
c) Advertising - not having Flash, or at least not enabled, can be a good thing here

Personally, I think the only justifiable use of Flash is for small in-browser games, and if you have kids, this may be unavoidable (think sites like Miniclip, Tanki, etc. ;-)
For videos, more and more sites don't need it anymore. I have also read that disabling it may give you videos of better quality, e.g. from YouTube.

If you're not sure whether you can do without Flash, then again my recommendation would be in Safari's Security preferences (Internet plug-ins website settings) to set Flash to "Block" for all websites, and then enable if for the websites where you find you need it.
It not only makes your system more secure, but also helps performance.