Disabling Java plug-in globally?
The answer is at http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/jcp/properties.html (Java 7) and http://docs.oracle.com/javase/8/docs/technotes/guides/deploy/properties.html (Java 8), though the instructions could be more explicit.

They say to set the deployment.webjava.enabled to false in your deployment.properties file, whose location is defined by the deployment.system.config property in the file ${deployment.java.home}/lib/deploy/deployment.config.

I found that you can just create deployment.properties in ${deployment.java.home}/lib, which I guess is a default location.

This raises the question of what the value of ${deployment.java.home} is, and it's not what I expected. I'm using OS X 10.7.5, and the value of deployment.java.home for me is /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home.

I created a deployment.properties file there with the contents:

deployment.webjava.enabled=false
deployment.webjava.enabled.locked=true


Now, when I open the Java Control Panel and go to the security tab, I see this:



There is that nagging "Only disabled for this user" still, but I think that's just a UI bug. If you log in as other users, you'll see that it's disabled for everybody.