why a traffic group must only have a mac address?

In v11, there can be up to 8 devices in a sync/failover device group. This means that the max amount of standby devices for any given traffic group is 7. If the MAC address for virtual IPs is assigned to the VLAN (stationary on the physical device) as opposed to the traffic group, your virtual traffic objects will change their layer 2 mappings up to 7 different times when the traffic group experiences a failover. For customers that want to ensure that the layer 2 mapping is consistent with their virtual traffic objects, the MAC masquerading must be assigned at the level of the traffic group. This causes less churn in the ARP tables of upstream/downstream switches. Additionally, this makes configuration a lot more straightforward. Instead of manually having to set up the masqueraded MAC address on each standby device, one only needs to set up on the traffic group. Finally, because an active device can support multiple traffic groups, it makes troubleshooting more straight forward, by preventing multiple traffic groups from sharing the same MAC address of the VLAN.