Repeaters: Secure or Non-Secure inclusion?

I’m currently expanding out my Z-Wave network, which means some devices will be outside the range of the controller itself. I’ve typically been including nodes securely, but given the overheads of S0 security in Z-Wave and the lack of S2 support in both many products and Home Assistant/OpenZWave itself I’m considering only including nodes when secure connections are strictly required (e.g door locks, motion sensors etc).

What isn’t clear to me though is if repeater nodes, be it either a dedicated repeater or a powered device that’s also acting as a repeater in the mesh, need to be securely included themselves in order to pass messages onwards for other securely included devices.

Is there any guidance in general how securely included and non securely included devices interact in the mesh? Although I’m primarily looking at this from a mesh repeating/routing perspective I’m curious too if there are any requirements around device association groups - e.g only a securely included switch or button can be used to control a different securely included device in the network such as a light.

Thanks!