Yeah, that's true. Good point. Secure Boot should help. Unfortunately, it's a pain for other reasons, like installing alternative operating systems. It also may not be turned on by default. I believe Microsoft only mandated it on devices with ARM processors (ie, running Windows RT). In other cases, the computer vendor is free to choose. Not sure. TorBrowser is supposed to be isolated to the folder it is extracted to, so it shouldn't know that Java is installed. That may only be the case for the Linux version.