javaClasses.cpp:

bool java_lang_System::allow_security_manager() {
  static int initialized = false;
  static bool allowed = true; // default
  if (!initialized) {
    oop base = vmClasses::System_klass()->static_field_base_raw();
    int never = base->int_field(_static_never_offset);
    allowed = (base->int_field(_static_allow_security_offset) != never);
  }
  return allowed;
}

We never set `initialized` to true, so every call to allow_security_manager() re-reads the System class field.