I assume you saw Early Testing for Untrusted (Encrypted) Devices?
v1.12.1-rc.1 should be fine, though ideally you’d still be using nightlies (I remember at least one untrusted-related bugfix since then). No starting to actually answer your post:
That’s the wrong order: You should never edit config.xml while Syncthing is running - it might save it’s in-ram config at any moment overwriting your changes.
That means that the folder on the untrusted device wasn’t added with as type “receive-encrypted”, i.e. the untrusted device acts as if it had the plain, not encrypted data (thus the “encrypton protocol” doesn’t work and there’s an error).
Suggestions on how to word this differently, so the meaning is more understandable, are very welcome!