Yes, we basically need to remove the methods in ReflectionHelper and have each caller do its own doPrivileged() block, passing the right action. Basically we need to copy the run() method into each caller class. It's a bit un-DRY, but I don't see a way around it.

+1 I don't see another way either

On a related note, we should also seal the JAR to prevent code being added to HV packages at other places.

Hmm, tbh I had not even heard of this until now. Sounds reasonable. Maybe this should be against a different issue though.