If advanced encryption was set up and assigned for specific attachment types after one or more attachments of those types was already added to VSys, those attachments don't get encrypted retroactively. Use the Apply encryption to existing attachments tool to do that.
Select one or more Attachment types, then click Run. For every attachment in VSys of those types that is not currently encrypted, VSys will apply the appropriate encryption key.