UpdatePortGroup doesn't properly handle null/undefined values in Network Security Policy

Security Policy Reference: https://github.com/vmware/pyvmomi/blob/master/docs/vim/host/NetworkPolicy/SecurityPolicy.rst

Running Python 2.7 on CentOS 7 (3.10.0-693.17.1.el7x86_64)

pyvmomi installed via pip version 6.7.0.

Steps to reproduce

#!/bin/python

import ssl
from pyVim import connect
from pyVmomi import vim

security_policy = vim.host.NetworkPolicy.SecurityPolicy()
# Comment out or change the any of the next three values to represent true/false/null
security_policy.allowPromiscuous = False
#security_policy.macChanges = False
security_policy.forgedTransmits = True
network_policy = vim.host.NetworkPolicy(security=security_policy)

hostname = "<esx ip>"
username = "root"
password = "<root pw>"
ssl_context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
ssl_context.verify_mode = ssl.CERT_NONE
port = 443
portgroup_name = "<port group name>"
switch_name = "<respective vswitch name>"

port_group = vim.host.PortGroup.Config()
port_group.spec = vim.host.PortGroup.Specification()
port_group.spec.name = portgroup_name
port_group.spec.policy = network_policy
port_group.spec.vswitchName = switch_name

service_instance = connect.SmartConnect(host=hostname, user=username, pwd=password, sslContext=ssl_context, port=port)
content = service_instance.RetrieveContent()
container = content.viewManager.CreateContainerView(content.rootFolder, [vim.HostSystem], True)

obj = {}
hostobj = None
for managed_object_ref in container.view:
	obj.update({managed_object_ref: managed_object_ref.name})
for host in obj:
	hostobj = host

if hostobj != None:
	hostobj.configManager.networkSystem.UpdatePortGroup(pgName=portgroup_name, portgrp=port_group.spec)

Expected Results

With the given code, I expected my port group to be configured with the security policy of

• Promiscuous mode: Reject
• MAC address changes: "Inherit from vSwitch" OR
• Forged Transmits: Accept

Actual Results

• Promiscuous mode: Reject
• MAC address changes: (no value is selected in the edit menu, but the Port Group info page says "Yes")
• Forged Transmits: Accept

Other Notes

If I make promiscuous_mode undefined or None in the security policy, everything else is ignored and the entire security policy is set to "Inherit from vSwitch" regardless of other settings.

Start with the Security Policy reference and the UpdatePortGroup call shown in the reproduction, then reproduce the behavior with each security policy field set, omitted, or None. Done means null or undefined fields preserve the expected inherited or prior values without causing other explicitly set policy values to be ignored.