You're close to 90% correct. Title 47 Part 15 covers what is normally referred to as the ISM bands and as long as you're operating under those rules (power limitations, frequencies, and interference) then you can absolutely use any encryption or protocol you like. Amateur licenses are not allowed to use encryption for the purpose of obscuring the message, and even the type of transmissions are restricted within those bands (some aren't allowed to be data, the protocol has to be published, must be using certain modulations on certain frequencies, etc).

Those frequencies are not exclusively licensed to ISM; Even some amateur radio bands overlap with bits of the ISM spectrum.

If you're operating under your HAM license even in the ISM band and within the other requirements you're in violation and subject to penalties. Though if you've met all the other requirements you can just claim you're operating under part 15 and be all set.

That "for the purpose of obscuring the message" part of the amateur requirements is rather interesting and some people have been playing with it, though there hasn't been any official yay/nay on what that exactly means from the FCC and AFAIK it's never been tested in court.

Theoretically if you broadcast an AES key then transmit 10 minutes of data encrypted with that AES key, you haven't encrypted with the purpose of obscuring as you've published the key with the transmission. Probably doesn't do much good in practice but there is a bunch of "edge cases" that may be interesting.