Hi,
It's a very good question. Your assumptions are correct.
Please take a look at kb below.
Can I encrypt an existing volume in place with NAE in ONTAP 9.6?
Answer: No. You need to do one of the following options mentioned below in the kb.
This is a useful kb:
https://kb.netapp.com/app/answers/answer_view/a_id/1086920/~/faq%3A-netapp-volume-encryption-and-netapp-aggregate-encryption-
All it suggests is that, you either create a new aggr and then move the vols, or turn the existing aggr with NVE vols into encryption and then move the vols. However, this means you will need enough free disks to create a new aggregate in the first place, or select any existing aggr with enough space. ( This may or may not be feasible)
Finally, I guess vol move is NDU in Ontap, so technically that part should be non-disruptive when you move vol to NAE aggr.
Thanks!