ImportExportTLSMode REQUIRE_FORCE does not have an expected effect

Hi
Vertica 10.1
I have configured all these security features:

SELECT SECURITY_CONFIG_CHECK('NETWORK');
Spread security details:

• EncryptSpreadComm = [vertica]
  Spread encryption is enabled
  It is now safe to set/change other security knobs

Data Channel security details:

• DataSSLParams is set
  SSL on the data channel is enabled

Client-Server network security details:

• EnableSSL is set
• SSLCertificate is set
• SSLPrivateKey is set
  Client-Server SSL is enabled

I also did set ImportExportTLSMode parameter to REQUIRE_FORCE, to make sure all the clients who are connecting, that their connection will be encrypted.

show current ImportExportTLSMode;
level | name | setting
----------+---------------------+---------------
DATABASE | ImportExportTLSMode | REQUIRE_FORCE

However, I am able to connect with vsql or with "JDBC Driver" without TLS.
Here I read, that "CONNECT TO VERTICA" can override this parameter **ImportExportTLSMode ** value, so that is why I changed it to "REQUIRE_FORCE"
https://www.vertica.com/docs/10.1.x/HTML/Content/Authoring/AdministratorsGuide/ConfiguringTheDB/SecurityParameters.htm

With vsql, I did try values "disable", "allow", both are connecting without TLS (with "prefer", "require" all good)

vsql -h hostname -U "dbadmin" -w "12345" -m disable

So here you can see from ssl_state column, there is "none"

select user_name, client_hostname, client_type, client_os_user_name, client_authentication_name, ssl_state from v_monitor.sessions;
user_name | client_hostname | client_type | client_os_user_name | client_authentication_name | ssl_state
--------------+------------------+-------------+---------------------+----------------------------+-----------
dbadmin | 127.0.0.1:56764 | vsql | dbadmin | local_trust | Server
ldap_user | XXXXXXX:65300 | JDBC Driver | ldap_user | LDAP2 | None
dbadmin | XXXXXXXX:57230 | vsql | dbadmin | network_passwd | None

When I connect with vsql utility without "-m", then ssl_state is Server.
So seems like this REQUIRE_FORCE does not actually force this TLS while connecting.
Regards
Raul