...
Returning references that refer to private data to untrusted code can be more pernicious than returning the references to trusted code. If a class defines a clone() method provides copy functionality that trusted code can use to pass defensive copies of the instance to untrusted code (OBJ10-J. Provide mutable classes with copy functionality to allow passing instances to untrusted code safely), the implementing class may violate this guideline. However, the burden is now transferred to the trusted code as it is expected to reliably call the clone() method before operating on the instance or passing it to untrusted code.
...