With this change I am also looking at "How can a feature pack disable activation of the security manager?"

This probably should be restricted to command line activation, in the future the JVM will also be taking care of disabling programmatic activation.