Injected<T> under the hood uses ServiceLocator, that's why it seems that it's working out of the strucutremap composed class. This cannot be removed so easily as there are lot of code still around that depends on this. In general even setter injections are considered worse compared to constructor injections. However there are many places inside EPiServer codebase that does not respect proper dependency injection principles (even in newly brewed components).
Some of you surely know about the class Injected. Basically, if you depend on IContentLoader in any(!!) class, you can fetch it by just creating a property like so:
... and it just magically works. This made me confused at first. Surely, the meaning of the Injected class must be to enable setter injection, I thought. And surely enough, there's a module that does just that - StructureMapInitializationModule.
Therefore, it's really confusing that Injected just works in any class - even a class where StructureMap doesn't create its instance.
By now, I've seen Injected in about every kind of class. Even view models, which are supposed to be dumb DTOs, have (almost) invisible dependencies to all sorts of classes. All thanks to Injected using the service locator as a fallback. The class encourages bad code design, and new developers don't understand why.
So can we please, remove the fallback to the service locator in Injected?! Maybe then, people can use the class as it is intended (edit: even though I don't see why they should use it in the first place - always go for constructor injection).