Currently the org.apache.cxf module in AS 7.x includes all cxf jars we provide on the app server. As a consequence, users get visibility over any classes from them when specifying a dependency on that module.
We should have separated modules for cxf-api.jar and all the other cxf jars.