Why can't I alter a security policy conditionally?
Statements go through three processing steps - parsing, binding and execution, in that order. This batch is failing at binding since it cannot find an object to match the typed words. The work-around is to use dynamic SQL.

See a related question here.