AES256/DES/ADP can be added in the field....assuming they didn't specifically order them with no encryption.
That is not correct as of March 5, 2020.
Prior to that date, the default was ADP (for free) and NO ENCRYPTION was an option that had to be specifically called out.
After March 5, NO ENCRYPTION is the default and you must specifically order any form of encryption, including ADP.
The issue is that subscriber units with NO ENCRYPTION must be physically returned to the factory to have any form of encryption added.
For this reason, I suggested that you order subscribers with Q667 (ADD: ADP NON CAP COMPLIANT) since it is a zero dollar addition and it permits you to add AES (or any other encryption algo) in the field.