Its because you did not specify the VPC ID in the properties in that case !Ref passes the name and you have to use the !GetAtt instead, if you include the VPC ID in the properties you can use !Ref to get the SG ID:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-securitygroup.html