I've came across that question on StackOverflow: https://stackoverflow.com/questions/18755713/how-does-final-play-a-role-in-security
The claim is made, that according to Wikipedia:
A final class cannot be subclassed. This is done for reasons of security and efficiency.
and the OP asked, how the security is achieved using final keyword.
What surprised me, most answers were claiming, that the final keyword would greatly increase security, because attacker won't be able to override your classes and calling your protected methods etc. They are mostly based on Oracle's article Secure Coding Guidelines
For example, making a class final prevents a malicious subclass from adding finalizers, cloning, and overriding random methods
However, with my understanding, if the attacker gains the possibility to execute arbitrary Java code on the targeted system (and if you are considered of him overriding your classes, he is expected to be) than he can already do everything your code is able to do, therefore it's completely irrelevant from security point of view, if your methods are final or not, or even if fields are private and not exposed or not (he can serialize your class and read every field etc.).
But on the other side, is it possible to find such real-life scenario, when attacker wouldn't achieve his goals by executing arbitrary code, and he would succeed only (or such attack would be considerably easier) by 'maliciously' overriding your classes, such as described in Oracle's article? For example, if the application server is shared by multiple Java applications?