I have set an issue security scheme for one of our projects.

There is only one security level (hence, it is the default). (see issue-security1.jpg)

Upon creating a new issue, that security level is not applied to the issue.

Trying to associate the security scheme again shows that there are issues that have no security level but it doesn't allow to set the level again. "The project is already associated with this scheme" (see issue-security2.jpg)

This seems to happen only if the security level field is hidden in the field configuration. (Although it wouldn't be shown to the normal user in any case because lack of permission.)