Because PSECURITY_ATTRIBUTES is an access (pointer) type and you haven't allocated an instance of it:
type PSECURITY_ATTRIBUTES is access all SECURITY_ATTRIBUTES;
So you have to allocate an instance of it first:
SecurityAttributes : PSECURITY_ATTRIBUTES := new SECURITY_ATTRIBUTES;
(Since it's a pointer type, you don't need "aliased".)
Now you can assign to it:
SecurityAttributes.nLength := 123;
Alternatively, if SecurityAttributes were declared aliased of type SECURITY_ATTRIBUTES, then your original assignment would have worked. Going by the name, I strongly suspect the leading 'P' is intended to indicate the type is a pointer type.
This has not been compiled, I'm going by an on-line source code listing.