you're messing up config/routes/security.yaml with config/packages/security.yaml, they are different files and have different purpose, one is for routing so '_security_logout' part should be here, and the latter one is for configuration so 'firewall' part here.