Inconsistent display of policy types

On the Policies page, the Type dropdown control shows 10 types of policies and the Create Policy dropdown control shows 7 policy types. Does anyone know why these are not the same? is this a UI bug?

Malware detection, OAuth app anomaly detection, and OAuth app policy are the 3 extra items on the Type dropdown