This I also believe is intended because we want to inheirent dependencies from the security module directly under the root of the source tree, even though it lives under the extension one.