The 'extra' size of the contents in a saved region is accounted for by the fact that the entire region is saved as a BIN file, not just the usable data in it. The extra space is indicated by empty FFs at the end of the BIN viewed in a hex reader. If the FFs are removed the hash files of the original bin file and the shortened dumped bin file should match.

Certainly devices listed in the first post (and also Drive 52 for further example) have encrypted firmware.

PS: It's worth noting that rgn12 is usually a virtual region which in turn flashes rgn5 (the bootloader) and rgn43 (the X-loader).