EC2: Why does Vpc.FromLookup return a IVpc making VpcDefaultSecurityGroup not work

### Describe the bug

I have a String Parameter with a VPC ID from another stack (completely different CDK Project) which I need to lookup so that I can add a Ingress Rule to that Security Group to allow traffic.

### Expected Behavior

I expect the following code to add the rule
```
var rdsVpcId = StringParameter.ValueFromLookup(this, $"vpc-id");

var rdsVpc = Vpc.FromLookup(this, "VPC", new VpcLookupOptions
{
VpcId = rdsVpcId,
});
var sgName = rdsVpc.VpcDefaultSecurityGroup;
var sg = SecurityGroup.FromSecurityGroupId(this, "RdsSecurityGroup", sgName);
var modulePeer = Peer.Ipv4(vpc.VpcCidrBlock);
sg.AddIngressRule(modulePeer, Port.Tcp(5432),"Microservice VPC");
```

### Current Behavior

I get the following error

error CS1061: 'IVpc' does not contain a definition for 'VpcDefaultSecurityGroup' and no accessible extension method 'VpcDefaultSecurityGroup' accepting a first argument of type 'IVpc' could be found (are you missing a using directive or an assembly reference?)

### Reproduction Steps

Create VPC and store the ID in a string parameter.

Include the above code in a CDK project stack.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.128.0 (build d995261)

### Framework Version

_No response_

### Node.js Version

10.2.3

### OS

Windows 11

### Language

.NET

### Language Version

8.0.102

### Other information

_No response_

Start by tracing the C# entry points Vpc.FromLookup, IVpc, and VpcDefaultSecurityGroup in the AWS CDK EC2 APIs. Compare the returned IVpc surface with the concrete Vpc API and existing imported-VPC behavior, then run the relevant EC2 and .NET binding tests if available. Done means a VPC returned by FromLookup can support the documented default security-group lookup or the limitation is clearly documented.

Written by the indexing model from the issue text.