System.Security.Permissions only has a netstandard ref configuration and as such will bin-place that into the ref/netfx folder when building the netfx vertical. This library seems to be the last one that is still using PackageAsRefAndLib https://github.com/dotnet/corefx/blob/1a8531aa3c511d78a1520c40f4595334a8ba3ada/src/System.Security.Permissions/src/System.Security.Permissions.csproj#L9.

We should remove that and instead add a netfx configurations for the ref so that our own projects can correctly consume this library.

As a temp workaround test projects can add the:

 <ItemGroup Condition="'$(TargetGroup)' == 'netfx'">
    <!-- Work-around issue where we are bin-placing the netstandard ref for System.Security.Permissions for netfx -->
    <TargetingPackExclusions Include="System.Security.Permissions" />
  </ItemGroup>