What feature would you like to have in the provider?
At present there does not appear to be a way to update security_group external_sources. The provider always appears to want to create a new security group.
For those of us who have hardened IAM policies surrounding security groups (i.e update, but not create or delete) it means we are stuck.