Be Ware, if you have a device that cant be updated anymore, like an old iPhone or iPad, Apple forces you to delete that device from you account in order to proceed with the encription, losing synchronization with iCloud on those devices.
So Apple chooses when a device stops getting software updates and that makes the device unfit to keep being synchronized with the cloud in a secure manner
It would have to be super old. My 2015 and ‘16 iOS devices were fine. The only thing I had to remove was my 2010 white MacBook (which I just keep around to run home media anyway).
Yes, IIRC when they rolled this feature out it was an automatic upgrade to On, except if you had devices on your account that were too old to support it.