Azurerm_network_security_rule vs azurerm_network_security_group.security_rule

What are the pros/cons of using
azurerm_network_security_rule vs azurerm_network_security_group.security_rule?

The docs say you can’t mix and match, but is there any other benefits to having them separate or combined?