The contract of the method is to provide a list of classes given a URL. In case of JAR files it would be enough to use JarFile#entries. However, since the implementation delegates to ClassFileVisitorUtils using an implementation of the visitor, the JAR files are being read completely, including the streams of the individual classes.
This is a considerable performance hit. Specifically, in our project we have vast amount of Maven modules and do a dependency validation for them. By replacing the current implementation with one that uses JarFile#getEntries we were able to reduce the build time by 4 minutes.