I am trying to find a thread that might be related to this within the forum, but I couldn't.
Though, I feel I should mention that on other DCP authoring programs, the choice to encrypt only some of the essences of a DCP is there. My experience comes from using CineAsset, where one could tick boxes on what essences were meant to be encrypted. On top of that, I have had in my hands at least one SMPTE DCP made on a third party authoring program that had the subtitles (only) non encrypted.
Therefore, if the question is that the essence created by DCPoMatic (for the VF) was not encrypted, that is not unheard of.
If it is that it (the new material) was not encrypted, but, without a KDM for the specific CPL that would include all the essences in question, the CPL should not play with the player, even if the KDM available includes all of the files that are encrypted (a repackaged DCP and rebuilt CPL) and is for the same target machine... well, it doesn't make any practical sense (with the keys available), but one can argue that it's the appropriate behavior.