In principle it's super easy to detect, encrypted files look like random data and it's unlikely users would be replacing every file with random data on purpose.

In principle it's super easy to detect, encrypted files look like random data and it's unlikely users would be replacing every file with random data on purpose. Its a never ending war though. If you got enough users to do this, the hackers would then switch to encryption that mimics what normal files look like to fool the detector.