You can't change Providers while running under the SecurityManager he specifies you must use in the rules.

SecurityManager.checkSecurityAccess(java.lang.String) is called if you try and mess with the Providers.

You're right, looks like a Timing Attack might be the only solution that satisfies the spirit of the test.