3 general options:
1. No encryption programmed into radio.
2. Encryption is switchable (on or off)
3. Encryption is "strapped" or: Always on.
The problem with the switch is that it is way too easy for a radio user to forget to turn it on or off. Yeah, you can program tones/lights to remind the user, but there is zero security in communications if you allow users to turn it on or off, because someone will -always- forget to turn it on.
It's more common for encryption to be "strapped". That is, it's programmed so that channels/talkgroups are -always- encrypted.
That's the 10,000 foot view, overly generalized. There's a ton of details involved. Most radios will permit many different encryption keys to be stored in the radio, so channels that are encrypted can have different encryption keys.