Having this META-INF/services file here means a caller could potentially try and load core's RuntimeVaultReader via this module instead of via core's server module. Which might work, or might partly work or... Since no code in full needs to load an AbstractVaultReader via this module I see no reason to support it.

The vault resources in the security subsystem do not provide an AbstractVaultReader; they provide a Service (SecurityVault being the picketbox class.)