Comment 1 for bug 1748097

This is the intentional behavior of nova API.

When you see the list of request parameters of create-server API [1], the description of "networks.port" field says "Requested security groups are not applied to pre-existing ports."

[1] https://developer.openstack.org/api-ref/compute/#create-server