Thanks for the suggestion. I tried adding the line for a VMX file to a Windows 2012 R2 VM and got this popup:
Feature 'cpuid.AES' was 0x1, but must be 0.
Module FeatureCompatLate power on failed.
Failed to start the virtual machine.
I tried different variations on it, for example
featMask.vm.cpuid.aes = "0"
featMask.vm.cpuid.aes = 0
featMask.vm.cpu.aes = "Val:0"
I did not complain about any of them, but AES-NI was still enabled.