Interesting note: modern high-density NAND flash ("TLC", "QLC") is so sensitive to the data patterns being written (writing zero bits causes more wear than writing 1 bits - the latter being the default non-written state of the medium) that controllers need to use a scrambling algorithm to statistically balance the number of 0 and 1 bits that are written. Earlier schemes were based on LFSRs or similar, but then I guess someone noticed that an encryption algorithm would also do a similar job, with the advantage of it being much harder to create pathological cases (look up "CD-ROM weak sector protection" for an interesting rabbithole related to that) and "self-encrypting drive" also be a good marketing point.

On the other hand, it's a nightmare for data recovery, especially the "I didn't ever mean to encrypt this drive, what do you mean you can't recover it?" situation.

There's some discussion of the older version of that scheme (not encryption-based) here: https://joshuawise.com/projects/ndfrecovery