This delegation model is the real defense that stops malicious code from replacing java.lang.String, and it's also central to how servers like Tomcat isolate each deployed webapp with its own classloader so two apps can run different library versions side by side. Understanding it is essential background for reasoning about supply-chain classloading issues like Log4Shell (CVE-2021-44228), which exploited how JNDI lookups trigger dynamic class loading.