JBossAppParsingDeployers does not actually parse jboss-app.xml when no application.xml descriptor is provided. In that case, the EARContentsDeployer creates a JBoss50AppMetaData instance and attach that to the deployment unit. Later JBossAppParsingDeployer (actually AbstractParsingDeployerWithOutput::createMetaData(DeploymentUnit unit, Set<String> names, String suffix, String key)) finds the metadata are already there and returns without doing the actual parse.
A consequence of this is that, for instance, a security domain declared in jboss-app.xml is not picked up.