FWIW: I now remember why I encrypted my Windows VMs.

Windows 11 requires a (virtual) TPM (Trusted Platform Module). Fusion requires an (at least partially) encrypted VM in order to add a vTPM. So when I upgraded to Windows 11 I encrypted my VMs.