Extra checks are needed not only when attaching a policy route to an interface, but also when attaching firewall.
For example:
vyos@vyos# set firewall name FOO rule 10 action accept [edit] vyos@vyos# set firewall name FOO rule 10 destination group address-group NOAG [edit] vyos@vyos# commit