After learning about Pegasus I wouldn't do anything on a phone. Stick to using emails hosted as a hidden service and encrypt everything server side.
If the person you are engaging cannot do that nor wants to learn to upgrade their OPSEC, they can kick rocks. I do have to ask, why do we really need java enabled just to post?
I can see disabling a few security features to watch videos, download stuff, etc. But I cannot understand why not give users the ability to post with java disabled as it has been proven in the past to be a flaw law enforcement loves to exploit.