Current state of things is everything is encrypted as it is in transit, and at rest - but Apple holds those keys. ADP, if turned on, would mean Apple didn’t hold the keys (only your devices would).
You can still use individual note encryption in the current scenario for zero knowledge encryption.