Encryption is at the option of the network. Source: connected some cdma2000 mobiles gotten at retail to test equipment without any keys required; connected a DO mobile that probably didn't have any special config, also no keys required.

An attacker couldn't MITM between a mobile and a network that uses encryption, but it could redirect a mobile to the real network if the victim tried to set up a call.