title: modifying a public static final array
body: <p>While designing a small API, i was about to write a static value that references to an array of String:
  <code>public static final String[] KEYS={"a","b","c"}</code>
  I have found this to be marked as a 'security hole' in Joshua Bloch's 'Effective Java' item 14, where he proposes as an alternative, declaring te array 'private' and provide a public getter that returns an unmodifiable list:</p>
  
  <pre><code>return Collections.unmodifiableList(Arrays.asList(KEYS))
  </code></pre>
  
  <p>I just cant see why would this be necessary, the array in the initial statement is declared final even though its public, and its elements are immutable, how could that be modified from an external piece of code?</p>