When Martin wrote this book, REST (REpresentational State Transfer) and SPA (Single Page Application) were not very popular yet. I think he was looking at a Server-Side Rendering architecture, like JSP/JSF, where a fully generated view is sent to the client, not its state. In this architecture, controllers are indeed part of the presentation layer, as they are responsible for displaying data and handling user interface events. Therefore, it was more logical to place security functionality in the service layer. However, in the REST architecture, the role of the controller in forming the user interface has significantly decreased. The presentation layer has almost completely moved to the client's browser, and controllers are left only with processing HTTP requests. In REST architecture, controllers can no longer be part of the presentation layer, they have created a new layer - API, into which security functionality fits harmoniously.