So what are GC roots for the classes?
Classloaders, effectively – via other GC roots.
If there is nothing which can reach a classloader – which means nothing can reach any classes created by that classloader or any instances of those classes – then both the classloader and the classes it created are eligible for garbage collection. Keeping them alive until then is necessary so that Class::forName and ClassLoader::findClass can be idempotent even when the class’s static initializers are not.
Hidden classes (see https://openjdk.java.net/jeps/371) are exceptions to this rule. As an implementation detail of OpenJDK, so are the classes of method references, lambdas, and proxies created with the static methods of java.lang.reflect.Proxy. The classloader does not hold a strong reference to these classes.