From what I understand the CAN traffic on my vehicle is encrypted. Clearly this does not apply to all of the traffic, as I can fetch some OBD2 data with a generic dongle.

The data on the OBD2 port is legally mandated, so can't be encrypted. But besides encryption CAN buses in a car are also separated, the bus on the OBD2 plug often can't even talk to the most interesting components.