This is one of the reasons I opt for PayPal in the US when I have the choice. I've been in too many breaches. Direct to bank would be better, but I trust PayPal's security more than a random ecommerce website's security.
Not true. You can use the OpenJDK for free until the end of time. If you want ongoing updates beyond six months, there are a bunch of free distributions: Azul Zulu Community (7/8/11/13/14), AdoptOpenJDK (8/11/14), etc.