I know Java is considered unsafe, but damn, it can steal files from your hard drive?

Another question, isn't virus/malware protection supposed to prevent keyloggers and malicious Java apps from running? I guess there are always exceptions that can work around those, but as a general rule?