The [system] dictionary is walked to determine the protection domain oops that should be strong roots, so scans the system dictionary to find classes whose initiating loader is the NULL boot loader. The NULL boot loader doesn't initiate any classes not defined in the NULL loader so never has any protection entries in the set.

  // Classes loaded by the bootstrap loader are always strongly reachable.
  // If we're not doing class unloading, all classes are strongly reachable.
  static bool is_strongly_reachable(ClassLoaderData* loader_data, Klass* klass) {
    assert (klass != NULL, "should have non-null klass");
    return (loader_data->is_the_null_class_loader_data() || !ClassUnloading);
  }

For the case of !ClassUnloading all the protection domain table entries are strong roots, so don't require this walk either.
This is an unnecessary walk during GC and class unloading.