JDK-8344943 suggests that this class can be made final.

As a follow up to that, it was noticed that the now package-private constructor of ModuleDescriptor could be made private. It is only accessed from the class itself, via JavaLangModuleAccess.