Maybe 10 or 12 years ago I was an expert. But I've not done anything serious with Java for a while.
What you say is correct. Java and Javascript are two separate beasts. They simply share the first four letters in their names.
Javascript is a scripting language that is interpreted from the source code.
Java is compiled into byte-codes that theoretically can run on any Java Virtual Machine (JVM)
The idea was write once, run anywhere and platform differences were handled by the JVM, so if you asked to open a file, the JVM would know how to do it on a particular host.
Applets (Java byte-code running in your browser)were supposed to be in a well protected sandbox, not allowed to access files on the system, only allowed to open network connections back to the webserver where they originated, etc. I suspect the security model was relaxed because folks wanted to do more and now we have more exploits. (For example, when java first started, you could not access the printer from an applet in the browser.)
The JVM is also computer code that is suspect to same sorts of attacks any other code might suffer. Buffer overflows and other bugs can and have been exploited.
Like any software, it's best to remain current and keep it updated with the latest bug and security fixes.
Edited to add, I was part of Sun's very first "Train the trainer" where they took techincal instructors with a programming background and taught us enough Java that we could turn around and teach it. Back in 1996, it seemed the course-ware was changing almost as fast as the JVM and the language itself. I had to carry several versions as I never knew which version would be in the classroom as I traveled around the US teaching folks about this new and exciting language.