They can, but it can be difficult to make use of.

As readObject is only a "psuedo-constructor", it cannot initialise final
fields. ObjectInputStream will create the object with null/0/'\0'/false
for that field.

There are a few ways around this. java.util.Random in 1.6 cheats by
using sun.misc.Unsafe. It may be possible to introduce a superclass that
does not implement java.io.Serializable but has the field with
appropriate initialisation (unlike Serializable subclasses, it's no-arg
constructor will be called). Or you can use readResolve to construct a
replacement object (this does not play so well with inheritance).

Tom Hawtin