According to Michael Tsai, they did use encrypted notification payloads. The OS just then stores the decrypted payloads in its notification database. [0]

[0] https://mjtsai.com/blog/2026/04/10/notifications-privacy/