Features such as code access security or reflection incur massive overhead, even when never used.
I am not aware of a cost of reflection in Java when it is not used.
Not even in how it constrained the design, which it didn’t.
I think I know how to provide reflection in C without changing the compiled code.
Ditto dynamic program loading.
Certainly new code must be vetted the same way its caller was.
This can be done when any time after the code was written but before it is called.