TL;DR: The latest version of what used to be Forefront doesn't seem to support the Essentials OSes.
Ok... where to begin.
The latest version of what used to be called "Forefront" is now part of System Center Configuration Manager (SCCM) 2012 R2 and it's called System Center Endpoint Protection (SCEP). Installing SCCM is a gigantic PITA. And there really is no official standalone installer for SCEP.
So... I found the actual EXE (scepinstall.exe) standalone installer on the CD and tried installing it that way.
I thought that perhaps the version of this installer is too old and doesn't support 2012 R2 / Win 8.1.
So... I found the latest version by requesting a CU2 update hotfix from MS for SCCM, which contains a newer version of the installer. I extracted the SFX, then extracted the MSI and pulled the EXE installer for SCEP out of there.
But, same error as above. This is version 4.5.0216.0 from May 29 2014.
So... I then tried running the same installer on a non-Essentials version of 2012 R2 (with the Essentials role installed) and guess what, no error.
Confusing isn't it! This is where I'm at now.