Writing encrypted data in place Is there a good reason not to write encrypted data in-place?  

From the iOS 10 Security Guide:
Well, in this particular case, AES-GCM is being used.  As GCM adds authentication tags to the output stream, the size of the output stream is greater than the size of the input stream.  Writing the data in place would require a certain amount of buffering that could become difficult if the input stream is large enough.

Not to mention this helps defend against a power failure/crash in the middle of the encryption.  Imagine if the encryption process was stopped at some point.  When the system recovered how would it know where to start encrypting again?  With a separate encrypted stream the recovery process is easy - just start over at the beginning.