Currently, kernel.controller is dispatched between the resolution of the controller and the resolution of arguments. this is great as it means that listeners can replace the controller being found.

Currently, SensioFrameworkExtraBundle also uses this event to alter the Request object for ParamConverters so that the argument resolution will see these objects, and then run the Security annotation, relying on these converted objects being in the Request.
If the argument resolution refactoring (#18308) is merged, we would need to make security check run after the resolution of arguments (to be able to use objects converted by the ArgumentResolver in expressions, and then deprecate ParamConverter in favor of custom value resolver).
For that, I suggest adding a new kernel event triggered between the resolution of arguments and the call to the controller in HttpKernel (name of the event to be discussed). this event would not allow to change the controller (it could maybe allow to change arguments, but I'm not sure it is necessary).