...
Neither the original array values nor the public list can be modified by a client. For more details about unmodifiable wrappers refer to SEC01-J. Provide sensitive mutable classes with unmodifiable wrappers.
Risk Assessment
Using final to declare the reference to a mutable object is potentially misleading because the contents of the object can still be changed.
...