From: BenLand100
This is based on the assumption that unsigned applets require that rules be enforced — they don't. Sure, Jagex could try to do something 'illegal' in the unsigned world, and notice it works, and make appropriate inferences about why that may be, but there is nothing to prevent an unsigned applet from running without a SecurityManager. In fact, iirc, the presence of a security manager is the only difference between Signed/Unsigned/Local programs. The runescape client will behave as if its unsigned if it thinks its unsigned, regardless of the security manager.
Granted I haven't tried really recently with the runescape client, but at least as recently as revision 525, even if you run runescape.jar (the unsigned client), it will still write to the hard drive just like the signed client will, the only thing that stops it is a SecurityManager. Is that not the case anymore?
I have written a GPL'd SecurityManager for my MoparScape client that could be 'plugged into' SMART rather easily, if you are interested.