Enabled by default when Secure Boot is on, so Flash Encryption protection is always available in case of a Secure Boot bypass.