Yes - but all the time-consuming bugs in server development are like that (all the others are so simple to fix, relatively speaking, that they usually don’t impact the development time by a significant percentage).
Sorry, I didn’t mean to say that no MMOG servers had been hacked - but bear in mind that a typical MMOG ought to be receiving approximately 200 hacking attempts EVERY DAY (a relatively pessimistic estimate based on my knowledge of how many attempts are made on typical web servers, and on how many attempts I’ve seen on game-servers I was running).
There have been public statements on something like 100 hacks of MMOG’s (I’m guessing, and aiming at an upper limit - most of the announcements get withdrawn quickly so it can be hard to keep up with them :)). So, where are the other 20k attempts that have been made on EQ, UO, etc? Surely we’re not looking at a one-in-ten-thousand success rate?
OTOH, if you look for evidence of client-hacking, it’s like a plague - it’s everywhere. And, in most cases, it’s successful. I have tons of info on this, but look around and you should find plenty of different tools, cracked clients, MMOG trainers, etc.
Well definitely not the first, since I’ve written a Game Programming Gem on precisely that topic :). Actually, none of the above…
Assuming an expert Java/C++ programmer, and a properly managed MMOG dev team, Java does not reduce the number or severity of bugs, averaged over time.
Unit tests do. Regression test do so even more. Automated idiot tests like the ones Larry and co used in TSO seem to be the best of all (AFAICS this is mainly because it’s too hard for normal devs to write great unit tests for distributed apps - the idiot tests are much easier to write).
Re: other games, and the 3rd party libs…The point about immaturity of 3rd party and lib support is good. But from my POV, so many commercial games studios write all their own tools - including custom Maya + 3DS + etc importers and exporters - that I can’t see any difference in their development process if they switch from C++ to Java. I’m being a bit theoretical here, forgive me :), but it seems to me that in theory there’s no problem now that Java has decent, tested, supported OGL access [even if not perfect] (and commitments for ongoing support, particularly from Sun). Sorry to have excluded individual developers from that POV 
