I did some grepping and found a number of tests that still do something with the SecurityManager even after JEP 486 (disabling the SecurityManager) was integrated. I think we can remove mention of it in these tests

java/awt/datatransfer/Independence/IndependenceAWTTest.java
java/awt/datatransfer/Independence/IndependenceSwingTest.java
java/awt/datatransfer/SystemSelection/SystemSelectionAWTTest.java
java/awt/datatransfer/SystemSelection/SystemSelectionSwingTest.java
java/awt/print/PrinterJob/PrintToDir.java
java/awt/Desktop/8064934/bug8064934.java
java/awt/TrayIcon/SystemTrayIconHelper.java
java/awt/a11y/AccessibleComponentTest.java - this one is different - unused import of java.security.PublicKey;
java/awt/event/InputEvent/ButtonArraysEquality/ButtonArraysEquality.java
java/awt/event/MouseEvent/CheckGetMaskForButton/CheckGetMaskForButton.java
java/awt/regtesthelpers/Util.java
javax/swing/UIDefaults/6795356/bug6795356.java
javax/swing/UIDefaults/6795356/bug6795356.java
javax/imageio/spi/AppletContextTest/BadPluginConfigurationTest.sh - maybe just a leftover comment ?
imageio/metadata/IIOMetadataFormat/MetadataFormatThreadTest.java