I enabled FileVault on APFS encrypted volume (don't ask why). Then I disabled FileVault. The device was automatically decrypted. After that, I enabled volume encryption with diskutil (
diskutil apfs encryptVolume <disk>). Now, the disk can be only decrypted with the disk passphrase, not with the user password (although local open directory is within crypto users on disk.) I am able to click my user on "pre-login" screen to unlock the drive, but my password does not work. I need to get into "Disk password" option.
diskutil apfs updatePreboot <disk> does not help.
Moreover, quick help in disk tool shows
warning: invalid dstream.default_crypto_id (0x0) for encrypted volume, given apfs_fs_flags (0x8). This does not appear if drive is decrypted.