It depends on the plugin. Some security plugins have settings that will check folders outside of the current WP install. Others don’t. Some plugins may have complications if they are installed both places. Others won’t.
With Wordfence specifically, both sites would need the plugin installed, and there are not issues with running the plugin in two “nested” sites. You’ll just want to double-check that it’s not set to scan folders outside of WP.