On the Web VPM, there is no option to add the Policy Services layers - Access Security and Content Security.
There is no option to add the Admin Authentication, Admin Access and Admin Login Banner layer as well.
This is affecting the Legacy Java VPM also.
This is expected or by design because the VPM is a "Tenant" type.
On the SYSinfo, you should be able to see the 'vpmapp' tag where 'Tenant' is enabled.
<vpmapp><vpmxml-info version="631" ng-ver="260854" tenant="true"/>
Product version: 6.7.x and 7.x.
Environment: Explicit and Transparent proxy.
Since this is an expected behavior or by design, there is no option to change it unless the VPM is not been created with 'Tenant' type.
Management Center has the option to push a VPM policy as 'Tenant' type.