JEP 486 disabled the security manager and updated parts of the SE spec which referred to the effect on those APIs of a SM being in effect.
Probably because it is not in a java source file java/awt/doc-files/FocusSpec.html was overlooked.

Needs some small number of edits - and a CSR .