From the spec:
The deployment tool must first read the Java EE application deployment descriptor from the application
.earfile (META-INF/application.xml). If the deployment descriptor is present, it fully specifies the modules included in the application. If no deployment descriptor is present, the deployment tool uses the following rules to determine the modules included in the application.
It would be nice if glassfish gave some warning that your application.xml might not be completely specified!