Javadoc states (http://docs.oracle.com/javase/7/docs/technotes/guides/security/permissions.html):
Note: The "exitVM.*" permission is automatically granted to all code loaded from the application class path, thus enabling applications to terminate themselves
This applies when you run your code as independent application. The same applies for Tomcat - it may shutdown itself. BUT this is not expanded to programs run within Tomcat container. These programs are fully controlled by Tomcat security manager: (http://tomcat.apache.org/tomcat-7.0-doc/security-manager-howto.html)