boto3: Spot Instance Creation
Although it's not specified in the API documentation, apparently 'SecurityGroups' parameter requires the names of the security groups, not the IDs.
Changing to the group name solved the issue.
Thanks for anyone bothered to read the question in the first place.