There's a bug in the "Advanced disk configuration" step of installer.
On open, "Encrypt new installation" is greyed out and only available once LVM is selected.
But then one can unselect LVM and Encryption alone is accepted by the installer but it's not applied.
The result is a "vanilla" ext4 install without LUKS.
I think this is misleading and might give the user a false sense of security.