Unfortunately, this is true. If you want to use CDI -- a good idea IMO -- I would consider looking at something like Seam Security to provide your security. When working with CDI, Errai completely relegates responsibility for that stuff to the container. Thus, we do not provide our own security framework when working with CDI. Which is fine, because when working with CDI, Errai is merely an extension to the CDI container, and thus its components will be bound by whatever restrictions you put on them.
Thank you for your answer, I will take a look at Seam Security.