It's not just "security" . Had a problem a few years ago when the government changed the daylight savings dates. Some Java apps embedded their own version of the timezone database so didn't get updated.
Considering that a new version of the timezone database comes out every few weeks I hope this isn't as bad any more.