No, it was never supported to hack in some other security manager. We had two security managers (default and web) as we followed JSecurity pattern (and Nx was defunct if not "web" SM was used), hence, we do not check for "web" value (as there could be nothing else in there), nor we ever had alternative SM (that would work with Nx, to be precise).

The check for non-null was added only to "upgrade if needed", if the field is present at all, since many UTs and ITs are testing with some Security config and then testing for it's content equality, but those files have no SM field set nor the "outcome" file has it, without this null check all those tests would fail, as content of the files would not be same.