Spec 18.2.2:
"Since the timeout callback method is an internal method of the bean class, it has no client security context. When getCallerPrincipal is called from within the timeout callback method, it returns the container's representation of the unauthenticated identity."

Basically the ejbTimeout callback should have zero security checks (bypass auth, authorization, runas). This is in line with ejb2.