The CLI script that sets up the config used in testsuite/integration/elytron leaves an empty shell legacy security subsystem around, saying:

# datasources and ejb3 still has dependency on legacy security subsystem, so we can't remove it completely now

But actually removing it, the tests all pass but two. And one of those fails simply because it includes a setup task management up to disable JACC in the legacy subsystem, which would not be necessary if it were not present.

The other failure I believe is due to a flaw in the Elytron subsystem that will be fixed by WFCORE-4640. Basically in the absence of the legacy subsystem no DUP adds JASPI or JACC dependencies to the deployment module.