The big question here is why do you define the security manager later on?

Because I would expect you to want it from the beginning.

I suppose we could improve things but I really thought that people would either have set the security manager from the beginning or not at all.