Should we ever have `securityGroupsSupported` but `securityGroupExtension.isAbsent()`? Or would that be a bug?