`ExceptionHandlingConfigurer#createDefaultAccessDeniedHandler` should always fallback to `AccessDeniedHandlerImpl`

org.springframework.security.config.annotation.web.configurers.ExceptionHandlingConfigurer#createDefaultAccessDeniedHandler has this implementation:

LinkedHashMap<RequestMatcher, AccessDeniedHandler> defaultDeniedHandlerMappings

private AccessDeniedHandler createDefaultAccessDeniedHandler(H http) {
    if (this.defaultDeniedHandlerMappings.isEmpty()) {
        return new AccessDeniedHandlerImpl();
    }
    if (this.defaultDeniedHandlerMappings.size() == 1) {
        return this.defaultDeniedHandlerMappings.values().iterator().next();
    }
    return new RequestMatcherDelegatingAccessDeniedHandler(this.defaultDeniedHandlerMappings,
				new AccessDeniedHandlerImpl());
}

I'd propose that special case for this.defaultDeniedHandlerMappings.size() == 1 is not intuitive, because defaultDeniedHandlerMappings is always added for a specific RequestMatcher.

• If I don't add a handler for a request matcher, then AccessDeniedHandlerImpl is always used.
• If I add two handlers for request matchers, then AccessDeniedHandlerImpl is used when those matchers don't match
• If I add exactly one handler for a request matcher, then that handler is also used when its request matcher does not match

I assume the reason is backwards compatibility rather than design choice?
Sorry if it has been reported before.

Start with org.springframework.security.config.annotation.web.configurers.ExceptionHandlingConfigurer#createDefaultAccessDeniedHandler and inspect how defaultDeniedHandlerMappings is used with request matchers. Verify the single-mapping behavior against the stated fallback expectations; done means an unmatched request uses AccessDeniedHandlerImpl consistently, with the relevant behavior covered by tests.