ESPHome adds an explicit, temporary exception for installing encrypted-update firmware on a device that cannot yet receive encrypted uploads. It gives makers a single-install migration path alongside the existing two-step approach.
The allow_plaintext_upload option belongs under the update encryption settings. Keep the old update password for the existing firmware’s prompt; the new firmware still requires encryption, and a rejected encryption key does not trigger a plaintext retry.
After the device accepts an encrypted upload, remove the exception and the old password. Leaving the exception enabled lets an attacker on the network hide the device’s encryption offer and downgrade a later upload to plaintext. J. Nick Koston adds an upload warning explaining that cleanup.