Oracle patches critical Java bugs used to commandeer computers (ars technica)

No, it's clearly not worse.
It's still vulnerable, but to other bugs, which are not (presumably) yet exploited in the wild.

Also, in this case it appears that the applet runtime simply acts as vector to carry the interesting payload that actually compromises the system.

That being said, I was disappointed to learn how the applet security manager is put together, as it appears to simply trust call sites in the system framework packages. Given the size of the software, it seems likely that bugs like this will be discovered for years and years, and that every new API level will supply new bugs, unless this aspect of its evolution is strenuously reviewed.

Then again, if you just sign your applet, and socially engineer the user to run it, the security manager is turned off in any case, opening the door to further exploits just the same. If applets are to be salvaged -- and it is not clear to me anybody wants that -- then the operating system must be hardened to not allow browser to act as user's agent, i.e. with his privileges.

I tried to find out why the BankID "detector applet" wanted full access to the host system (the stock message in the security dialogue mentions access to devices including the webcam, which is surely a reminder of the days when Java was the hot new toy for Internet-based entertainment) when it is portraying itself as something that is merely checking for Java and presumably loading the appropriate payload (because, of course, Java portability on the client was such a huge success), and the only response I recall now was along the lines of "because it needs it".

In fact, the architecture seems to involve the "applet" (in fact, an "application" if one uses the dot-com era terminology) calling out to other Internet addresses and performing some kind of authentication dance. Of course, all this is in vain if the system is down, which then means you can just use the old-fashioned login mechanisms instead. Which the banks have kept around because BankID does go down every now and again.

My feeling is that a bunch of people got a budget to develop their own local solution in the hope that they could make it a more broadly adopted standard. However, every nation's banking sector probably have their eyes on the same prize, so those dreams will never play out. They were influenced enough to make it work only with a single vendor's technology - it's what the consultants know, after all - and the consequence of that is that everyone is now exposed to that vendor's fantastic track record in fixing security issues in a timely fashion.