There's a comment in WebRequestTraceFilter that explains the Order it has (LOWEST-10), so we can't just change the value, but it would sometimes (or maybe always) be useful to see requests in the /trace endpoint that were rejected by Spring Security.
The only way I can see to please all of the people is to use two filters, one with high priority, that starts and stops the trace, and one with low priority that updates any data that have been changed by the rest of the filter chain.