When all rules are deleted from a security group or policy, we should generate an empty ACL so that default deny rule can kick in. Without this change, after deleting all rules, we are allowing all traffic