That's a cheapo QLC drive making those numbers very conditional on several factors. Under sustained load it's not a surprise to see such drives drop to SATA speeds.
> So the limiting factor is the enclosure, that should still give me a generous 1000 MB/s.
That's capped by the USB controller, which means 512MB/s max.
I believe the USB controller still shares a bus with the NIC, which means maxing out the network connection will affect disk rw performance. You could confirm this by observing a concurrent iperf affecting fio results.
> The Raspberry Pi is notorious for not being excellent with encryption algorithms.
Well, that's specifically AES precompiles. Just like for kopia, you can benchmark and change LUKS algo for something more suitable for the platform like xchacha20: https://rr-developer.github.io/LUKS-on-Raspberry-Pi/