Yep, I see that too. Looks like it’s baked into the protocol.

Zwave will let you disable encryption or run without it. But it’s definitely still an option for zwave.

Both use AES 128, so there shouldn’t be any significant difference in security between them.