What's the reason SecurityState is missed for objects being just created with Metadata?

Hi,
I wonder why SecurityState object is missed for new objects even though they were created using Metadata which actually plays the role of a universal factory to a sense?

While it can be easily fixed by using AttributeAccessUpdater bean and the following snippet, I 'd like to have this default behavior clarified.

Thanks.
Ilia.

@Inject
private AttributeAccessUpdater updater;
...
updater.updateAttributeAccess(entityt);

up… Yuriy @artamonov?