From Wikipedia: "The first version was written by Rod Johnson, who released the framework with the publication of his book Expert One-on-One J2EE Design and Development in October 2002"
Just goes to show, if you start a software project, by the time it turns 10, an entire ecosystem around it will form. By the time it turns 20, people will forget why it was started in the first place, knowing it only as their Tao.
Also, for a very long time, Spring Security had native integration connectors for JBoss and maybe some other EE servers. They only removed these much later.