Which version of Elastic are you using now and as of a month ago? I know security was enabled by default on self-managed clusters as of version 8. There's an overview in this blog. But I'm not aware of the enrollment token being mandatory changing.
Someone else might know otherwise!