MACsec, at least when using static keys, is not setting encryption with/without the "security encrypt" statement.

It appears that python/vyos/ifconfig/macsec.py is missing "encrypt on" during the "ip link add link" statement. There's no logic to detect if encryption is set or not.