Once I worked on a team that none of the engineers knew that jwt payload was readable on the frontend. They were in shock when I extracted the payload and started asking questions about the data structure.
This is also, together with backend scalability, a major selling point for JWTs. Otherwise one might just as well use regular session ids in cookies.
You should use opaque tokens instead if you don't want the frontend or other services that have access to the token to read it.
An encrypted JWT is still convenient as it can be decrypted and deserialized into a common data structure using existing libraries.
The benefit of signing versus encryption is many services are able to verify the authenticity without needing a shared secret. That includes untrusted services, which is frequently the case with OAuth 2.
You can encrypt a JWT token, but at that point it's not semantically a JWT anymore. It can be any JSON at all and doesn't need to match the JWT structure. The first and last parts of a JWT are a signing algorithm and signature, respectively.