how could they escape the string and run code server-side
The only way an attacker could cause a string to be executed on the server-side, is if the server interprets the string code. If the server only echos the string back to the client, then the code cannot run server-side. (but, as you stay, can still be an XSS attack vector)
The following situations are the most common cases where a user-provided string could accidentally be interpreted as code, and therefore executed on the server.
SQL Injection vulnerabilities are the most common occurrence of this. In many cases, Java produces an SQL string, which, when combined with unsanitized or poorly escaped input, could allow the attacker to run arbitrary SQL commands. In most cases this is limited to accessing, updating or deleting the data that SQL user has access to, but in certain situations an SQLi attack could be used to gain higher access to the system.
A poorly designed file upload mechanism could use Path Traversal to place an executable file on the server, either for automated execution via cron, or in the docroot for execution via HTTP request. (a file download feature could also be vulnerable to path traversal)
Buffer Overflow vulnerabilities are a common occurrence in low-level programming languages such as C or C++.
Those who develop in a high-level language like Java have the luxury of automatic buffer allocation and will not be able to create one of these vulnerabilities in most situations.
However, sometimes a high-level language will tie-in to a vulnerable module. For example, an image processing or HTTPS encryption layer may be written in a low-level language to help it run faster.
As always, monitor your packages for security updates that may need to be installed.
Since java just compiles down to bytecode, is it possible to inject bytecode directly in a scenario like this?
This would require vulnerability (item 3 above) within the Java runtime, but the desired effect may be achievable with item 2.