Yes. The user loads the bytecode over the network and can decompile it.
You can make reverse engineering more difficult, but not impossible, by
using an obfuscater (google for detail). Decryption classloaders also
don't make reverse engineering impossible (the classloader itself can be
reverse engineered and then used to decrypt the "secret" code which it
should actually protect).

If you don't want your code out there on the net don't put it there.
Provide a web application and keep all your code on the server, e.g. in
some servlet and just send HTML pages to the user.

/Thomas

PS: Most code isn't worth reverse engineering. Are you sure that your
applet is so special that it needs the protection?