I ran into this too. Nothing worked until I rebooted, then I could see the XFRM interface actually going to running if config was aligned. Otherwise, it seems to never go to running. So I tried likely valid config before rebooting, so I thought it wasn't working for a bit.
Now, it was the /ip ipsec policy src-/dst-address=0.0.0.0 I never tried since I wasn't sure if the group= was a matcher on the policy, or merely a way to link the interface to the policy. But now that I think about it's why IKEv2 didn't work when I tried it (even after reboot), since that would need a broader policy than the /32 IPs of the two ends of the XFRM tunnel (which is what you get if you don't specify src/dst-address in a policy).
Anyway, the needing a reboot is pretty confusing, since IPSec starts confusing. Now RouterOS does not seem to need to for every change... as I could make the config invalid, and then valid again, and it comes back fine after a reboot sometime after adding the XFRM interface. But something isn't getting updated without a reboot, somewhere, here.