j.l.r.Module.getResourceAsStream spec states:
"Returns null if the resource is not in this module or access to the resource is denied by the security manager."
The spec doesn't specifies SecurityException in the throws clause.

However, the method throws SecurityException in case when SecurityManager denies access (read) to the resource file and (at least) resource is in an exploded module.
The method is also throws SecurityException if SecurityManager denies access to module path.

If the behavior of the method is not strictly specified, and if the behavior may vary depend on module type and other factors, it would be good to relax the mentioned assertion and add the SecurityException case to the throws clause.