The service policy limits the number of countries to 64. Security teams want to set an allowed list or a deny list. Since the world has 195 countries, its possible that a security team would want as many as half in either scenario. Since the console only allows for 64 items in the list either way, we have to burn a second security policy to list the other 30 or so items in the list. Having the list spread across two policies makes it less intuitive for humans. The maximum size on the list should be related to the real world scenarios its used for.