Yes, what you would be ordering is typically a lit L2 circuit. However, my experience is that certain carrier salespeople tend to call anything like this a 'wave'. I have had lots of discussions over the years with various salespeople about the difference, and yes, it's pretty much always lit L2. Centurylink (now Lumen) even sells a service they call "Encrypted Wavelength Service". Not sure how one encrypts light....
To go any distance of significance you don't do pure light, pumping the light increases signal but it increases noise too, eventually you have to regen the signal. Most of these active services are frame aware from first hop to last hop and encryption is on the cards without being in any meaningful way different to your unencrypted wave.
This is done typically even in short distances, as the signal you give them, is not the signal they want to put in their network, so they'll use a transponder to change it to something more applicable.
Passive optical mux is not the common case. But it indeed would not give opportunity for encryption in technology what we have today (but I do not understand enough to say it would be fundamentally impossible).