Java 9's final performance improvement when running applications with a security manager installed, came in the form of the java.lang.SecurityManager package enhancements. Specifically, the checkPackageAccess method's package checking algorithm was modified.
The java.lang.SecurityManager class allows applications to implement security policy on specific operations. The public void checkPackageAccess(String pkg) method, of this class receives a comma-delimited list of restricted packages from the the getProperty method. As illustrated here, depending on the evaluation, the checkPackageAccess method can throw one of two exceptions: