OCI security lists vs network security groups (NSG) — what's the difference?

A security list applies to an entire subnet; an NSG applies to an individual VNIC. They are independent firewalls — if you use NSGs, changing only the security list has no effect. Ports must be allowed on both sides.