Is it just an assumption? If you'll take a look into `ChannelAdapterSecurityIntegrationTests-context.xml` (the part of this PR), you'll see that all channels are implicit and security proxying works well for them.
And that is because `ChannelSecurityInterceptorBeanPostProcessor` is registered as `BPP`, not bean.