We appear to be living in parallel universes! We ran into this problem today as well.
You have assumed a default behavior of allowing access in the absense of method-permission declarations. This is not how JBoss defaults the security behavior. If a security-domain is defined then you must defined method-permissions to allow access to your ejbs or they will be inaccessible.