[singlow]

All network traffic that leaves a host should be encrypted. You could have an exception for a physically isolated network in a secure cage, if you're adventurous. But most of use are in cloud environments, so encrypted traffic is required. Even with VPCs and Security Groups, you don't want to rely on network ACLs alone to prevent data from being intercepted.

If Redis does not support encryption natively, then you have to run a gateway like stunnel on every redis host. The redis clients mostly all already support connecting to a secure socket, but the server and cli client require manual stunnel configurations. Native support for encryption just removes this extra setup.

[vetinari]

Encrypted doesn't mean TLS necessarily, and neither it means that it has to be at layer 7.

For the use case you are suggesting, wireguard network among your hosts would be simpler and without the need for each application to handle TLS.

[icebraining]

And how would we then connect our section of Windows workers, which are needed to run some proprietary software?

As long as wireguard is Linux-only, it's not an universal solution. TLS is.