File-based encryption security and backup/restore considerations
Apps can place data in either a Credential Encrypted (CE) or Device Encrypted (DE) storage, but does this necessarily mean all files in /data/ are encrypted?

What will be encrypted and which key is used depends on the encryption policy. The encryption policy specifies on a per-directory base what to encrypt. Exclusions (no encryption) seem to be possible, too.
The currently used policy us hard-coded in the source code of Android.
There you can read that currently some exclusions are known:

/data/apex
/data/data
/data/lost+found
/data/media
/data/misc_ce
/data/misc_de
/data/system_ce
/data/system_de
/data/user
/data/user_de
/data/vendor_ce
/data/vendor_de

For some of those exclusions there is an encryption policy for a subdirectory specified. However If I understand it correctly placing a files directly into one of those directories means that no encryption will be applied.