This:

https://github.com/wildfly/wildfly/blob/22.0.0.Final/security/subsystem/src/main/java/org/jboss/as/security/service/SecurityBootstrapService.java#L155

should be more like this:

https://github.com/wildfly/wildfly/blob/22.0.0.Final/ee/src/main/java/org/jboss/as/ee/security/JaccService.java#L111

They both deal with the 'org.jboss.as.security.jacc-module' but one sets the TCCL to its module and the other does not. SecurityBootstrapService not doing that means the module, if defined, has to be a dependency of the org.jboss.as.security module. Such a module would be custom, meaning the user is editing our module.xml, and we don't want that.