Replying to myself, but...
So, I also found
security/src/main/java/org/jboss/as/security/processors/SecurityDependencyProcessor.java
security/src/main/java/org/jboss/as/security/SecuritySubsystemAdd.java
which leads me to believe that it's Included. Is that correct?