What does the `ssl_encryption` parameter to `mysql.rds_set_external_master` actually do?

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/mysql-stored-proc-replicating.html#mysql_rds_set_external_master really makes it sound like passing 0 at the end of mysql.rds_set_external_master is going to result in an un-encrypted connection:

ssl_encryption

A value that specifies whether Secure Socket Layer (SSL) encryption is used on the replication connection. 1 specifies to use SSL encryption, 0 specifies to not use encryption. The default is 0.

However, we've found that leaving ssl_ecryption set to 0 works even for a user that we've configured to require ssl. Note the ssl_type=ANY here:

source> select user, host, ssl_type from mysql.user where user='replication';
+--------------+----------+----------+
| user         | host     | ssl_type |
+--------------+----------+----------+
| replication  | %        | ANY      |
+--------------+----------+----------+
1 row in set (0.032 sec)

So we're convinced that the connection is using SSL, despite the fact that we've set ssl_encryption=0 when invoking mysql.rds_set_external_master.

Is it possible that setting ssl_encryption=0 actually makes the target database connection to the source behave more like mysql client's--ssl-mode=PREFERRED, where it'll use a SSL connection if it can, but will happily fall back to non-SSL? And ssl_encryption=1 acts like --ssl-mode=REQUIRED?