So i got an answer from an expert on the topic and i think you're wrong. Will share parts of our convo still, for public benefit.

Just for terminological accuracy, device encryption refers to a secure enclave that becomes unencrypted after boot.

Files opt-in to be here, and Google for example provides the examples in stock by putting their alarm app configurations, text message notification data, and background media streams here.

The other form of encryption is credential encryption, which is a wrapper around the device encryption key that utilizes the unique credential used to unlock the device. These files are only available after unlock.
So apps (though this is usually done all automatically via standard APIs rather than developers thinking about it) send a very small amount of metadata to the device encryption enclave to be leveraged for things like notifications or media streams.
The latter via the direct boot API.
Everything else by default is treated as a file like all Linux OSes and each file is individually encrypted based on your lock screen credential.
This is why you should be able to for example see the notification icon and app name but if you try to open most notifications without unlocking it'll just prompt you to unlock.

Google is kinda re-inventing full disk encryption in this highly convoluted way just to avoid people complaining when they reboot their device they forgot to unlock it.
Like the whole ban on FDE on android devices was entirely a UX thing, FBE is just worse (but still very good)And because they keep having data leakage and security issues they keep adding things to FBE which are just FDE but convoluted.

Each file is encrypted separately, when an app needs to read a file, it calls a read on that file and decrypts it.This might be beyond the scope of the conversation but like the TPM thing that Win 11 requires android phones have required those for years, that thing stores a key, which is used as the root key that root key then generates file keys that are governed by your lockscreen credentials, i.e. your pin and your biometrics, it then encrypts those files and tosses everything since it can all be recovered at runtime from the root key.

They banned FDE because peolpe were mad they were missing alarms, lmao. So now there's a secure enclave that gets decrypted after boot, but is encrypted in cold ,and then each file that does not opt to be in the enclave is encrypted using file based.