Even though a talkgroup may be configured for full-time encryption, traffic on that talkgroup may still occasionally be unencrypted. If for some reason an individual radio on that talkgroup does not have the proper encryption key, all the other radios on that talkgroup are forced to transmit in the clear in order to maintain communications with that radio.
I have had DSD+ running, monitoring the Whitfield Simulcast site, for days at a time over the last month or so. The logs indicate that almost every talkgroup was in the clear at one time or another, however briefly. The unencrypted transmissions seem to be anomalies rather than the intended functionality. Even when the site is busiest, any clear traffic is usually from an agency in another county.