I believe scaling is accomplished in this case by having each node handle encryption. The fiber transport itself need not encrypt the payload. There are cases where businesses encrypt their leased dark fiber for compliance reasons so their limit would be whatever their VPN routers/appliances can handle at the time.