The only way it could end up null is if you pass a SecurityGroup created from another cloud than Nova - any Nova-created SG is gonna have the zone set up.