It looks like ModuleSpec does not make honor to the builder API documentation:

/**
* Set the permission collection for this module specification.  If none is given, a collection implying
* {@link AllPermission} is assumed.
*
* @param permissionCollection the permission collection
* @return this builder
*/
ModuleSpec.Builder setPermissionCollection(PermissionCollection permissionCollection);

My interpretation is if we do not add any PermissionCollection, then AllPermission is assumed. However, when we instantiate a ModuleBuilder the default permission collection is always null, and this ends up creating a ConcreteModuleSpec without permissions.