Method Security expressions that use templates do not use deep non-aliased attributes. A complete sample can be found in my sample repository, but is highlighted below:

@Service
public class Authz {
    public boolean hasPermission(Authentication authentication, Object object, String permission) {
        return true;
    }
}

@Documented
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.TYPE, ElementType.METHOD})
@PreAuthorize("@authz.hasPermission(authentication, {object}, {permission})")
public @interface HasPermission {

    String object();

    String permission();
}

@Documented
@Retention(RetentionPolicy.RUNTIME)
@Target({ ElementType.TYPE, ElementType.METHOD})
@HasPermission(object = "{value}", permission = "'read'")
public @interface HasReadPermission {
// If the alias is used, then Spring Security does work. However, there may be templates where a new variable is introduced and thus nothing to alias
//  @AliasFor(annotation = HasPermission.class, value = "object")
    String value();
}

@Service
public class MessageService {

    @HasReadPermission("#name")
    String sayHello(String name) {
        return "Hello " + name;
    }
}

This will produce the error Failed to evaluate expression '@authz.hasPermission(authentication, {value}, 'read')'.

I'd expect the expression to replace {value} with #name.