The semantics of the <distributable/> element in web.xml is such that all web fragments have to have one if the web application is supposed to be on the whole distributable.
From the JSR-315:
The web.xml resulting from the merge is considered <distributable>
only if all its web fragments are marked as <distributable> as well.
Therefore, provided the Seam Security External module can be used in a distributable application, its web-fragment should contain the tag.