Uh, both have been forever wrong using my GSIs?
I've never made any GSI without storage encryption, and My GSI have always been running SELinux enforcing.
Some kinds of GSIs have those kind of issues, but it's only those that are binary ports from OEM ROMs, like port from Xiaomi or OnePlus ROMs, but proper source-based GSIs shouldn't have those issues.