The communication is encrypted yes, but that's only part of it. Encrypted communication alone is not enough to supply security.

All of the actual logic is done on the adapter. The phone doesn't have a direct line of communication with the vehicle. When you say request the engine RPM PID, the phone will ask the adapter and the adapter in a mostly decoupled fashion will ask the car.

A big attack vector for say an ELM327, even if the communication is encrypted, is if you accidently download or get infected with a rogue app. That rogue app has full access to your ELM327 and Android and iOS will do pretty much nothing to stop it. The rogue app can then do something like jerk your steering wheel hard left. Not good.

The GateKeeper is also vulnerable to rogue apps but unlike the elms your phone can't access those dangerous control commands without doing additional security steps. So they may be able to pull engine rpm, but they won't be able to crash your car.