The type cast after readObject() is meaningless, the gadget chain fires before it. Java serialization here buys convenience, but it turns secrets write access into code execution.