Public final arrays are always modifiable. This is probably not was intended. I didn't check for public final List, Set and Map yet.
I don't think it is so important, I don't see any reason for someone to change the content of one of those array, I think we should trust developpers here.
And about the patch, I don't want to change ParserTokenManager as it is not our class but Beanshell class, I prefers beanshell remains exactly as the original one.
About ListVFSFileTransferable, changing the array to private would change nothing as the array is returned by a getter.
For AntiAlias, making the array private then return it with a getter do not reduce the risk.
But there might be compatibility problems if any plugin or macro use those fields.