Just in case someone else runs into the same issue I was just having, scratching my head attempting to create a direct association between zwave devices:
When it says they have to have the same security level, they mean exactly the same. I foolishly assumed S2 was S2 since that’s all I saw in the UI, but apparently S2_Authenticated =/= S2_Unauthenticated 
Hopefully this post saves someone else time troubleshooting 