Ever since we introduced RBAC in WildFly / EAP, we had this shortcut in place that we were documenting in EAP Release Notes:
Some resources are non-addressable to server-group and host scoped roles in order to provide a simplified view of the management model to improve usability. This is distinct from resources that are non-addressable to protect sensitive data.
I think that this shortcut is in place mainly because HAL can't cope with addressable but non-readable resources, but there might be other reasons. In any case, I figured I should finally file an upstream JIRA so that I don't have to bug Brian all the time if this has changed