It is assumed that you will obtain Java from the official source. If you obtain it elsewhere you multiply the risks.
Java is a complex language and like all non-trivial software, despite the writers best efforts, it will contain bugs. That is the reality with software. The writers of malicious software are often able to take advantage of these bugs to further their own ends. What they can then do is limited primarily by their imagination and abilities, and some are very good indeed.
The issue exists with all programming languages but because of Javas popularity it has attracted the interest of hackers. So once again, use Java if you need it, otherwise avoid it.