I know it's evil and all, but...
```
for (Zone zone : api.getZoneApi().listZones()) {
  if (zone.isSecurityGroupsEnabled()) {
    return true;
  }
}
return false;
```
seems a little easier to read and understand?