RMI (and similar technologies like CORBA) is a “mistake” in today’s world because it makes every public method an attack surface. It also hides important details that the client really can’t not deal with, namely network issues.

I put mistake in quotes because there are situations where RMI (and Java serialization) work fine: trusted, reliable networks like cluster or grid computing.