You can use
java -XX:+UnlockDiagnosticVMOptions -XX:+PrintFlagsFinal -version
to print all options and their defaults. If you have a debug build you can use this command to print comments for the various options as well:
java -XX:+UnlockDiagnosticVMOptions -XX:+UnlockExperimentalVMOptions -XX:+PrintFlagsFinal -XX:+PrintFlagsWithComments -version
PS: There are descriptions for most of them in this blog post: http://stas-blogspot.blogspot.bg/2011/07/most-complete-list-of-xx-options-for.html
Answer from Svetlin Zarev on Stack OverflowJava's Options for Options
java - Difference between _JAVA_OPTIONS, JAVA_TOOL_OPTIONS and JAVA_OPTS - Stack Overflow
JAVA_OPTIONS cannot be set in docker-compose.yml
Why does the environment variable _JAVA_OPTIONS exist, applies to jlink images, takes precedence, and can't be disabled?
Videos
You have pretty much nailed it except that these options are picked up even if you start JVM in-process via a library call.
The fact that _JAVA_OPTIONS is not documented suggests that it is not recommended to use this variable, and I've actually seen people abuse it by setting it in their ~/.bashrc. However, if you want to get to the bottom of this problem, you can check the source of Oracle HotSpot VM (e.g. in OpenJDK7).
You should also remember that there is no guarantee other VMs have or will continue to have support for undocumented variables.
UPDATE 2015-08-04: To save five minutes for folks coming from search engines, _JAVA_OPTIONS trumps command-line arguments, which in turn trump JAVA_TOOL_OPTIONS.
There is one more difference: _JAVA_OPTIONS is Oracle specific. IBM JVM is using IBM_JAVA_OPTIONS instead. This was probably done to be able to define machine-specific options without collisions. JAVA_TOOL_OPTIONS is recognized by all VMs.
I just spent a good chunk of time debugging an issue because a user had set _JAVA_OPTIONS to use a low Xmx value in their environment variables. This was an application created with jpackage, which should be fully standalone. It even had a custom Xmx value set in the JVM arguments for the image but the environment variable overwrote the value!
Isn't this like a huge design flaw? I can just do echo "_JAVA_OPTIONS=<Wacky VM options>" >> ~/.bashrc or setx to break literally every Java application on the system? (Edit: Maybe the initial security focus was wrong, changed it a bit to focus more on the design issues)
Who even thought that this would be a good idea with no option to disable this behavior?