A DESCRIPTION OF THE PROBLEM :
JSR 269 introduced annotation processing into Java.
However it was implemented that this is enabled by default inside the compiler and can be disabled with -proc:none flag. Annotation processors are also loaded via ServiceLoader.

The implementation happened nearly 20 years ago, in a time when build tools like Ant, Maven and Gradle had no widespread usage or didn't even exist yet.
Based on my observations, nowadays annotation processing is hardly used anymore and if it's used it mostly occurs after the actual compilation process in a build tool - with a specific Annotation Processor only.

Furthermore - because it's enabled by default - it may expose the user to a risk of unintentional executing code that should only be compiled.
Consider the following scenario:
* A new version of a library - used inside one of your programs maybe only transitively - get's released. However it is infected with a malicious annotation processor.
* The new version is picked up by your automated dependency update tool (e.g. https://github.com/renovatebot/renovate or https://github.com/dependabot) and a PullRequest is created
* The PR is picked up by a CI server which compiles the code to check if everything works
* When compiling the code the malicious annotation processor is executed and it may compromise your CI server

The above scenario can easily be mitigated with the -proc:none Flag, however as annotation processing usually occurs without any log outputs or additional hints, it's likely that most users don't even know that it's enabled by default.

So maybe it would be a good idea to disable annotation processing by default and enable it only when e.g. the -proc (without Arguments) Flag is set. This would be a breaking change, however it may be acceptable considering that the security improvements for most users outweigh the effort of some users to add a simple flag.