This article about Java security says:
Code in the Java library consults the Security Manager whenever a dangerous operation is about to be attempted.
It will only consult the SecurityManager if the code says so. It won't do it for every single operation.
For example in Runtime.exit, you see that the SecurityManager is consulted:
public void exit(int status) {
SecurityManager security = System.getSecurityManager();
if (security != null) {
security.checkExit(status);
}
Shutdown.exit(status);
}
Similarly, in File, you will see that most methods consult the SecurityManager. Example:
public boolean canWrite() {
SecurityManager security = System.getSecurityManager();
if (security != null) {
security.checkWrite(path);
}
return fs.checkAccess(this, FileSystem.ACCESS_WRITE);
}
If you are writing a method which might be "dangerous" then you should also consult the SecurityManager.