The haks exist in that folder before you start the module, that is why you have the data available to open in the first place. The hak file is not at all modified when the file is opened for reading by the aurora engine.
The encrypted haks are hak version 1.1, rather than 1.0. They use a least a portion of the additional reserved 116 bytes of the header to encrypt the packaged data. I did some testing on the files and found that the header differs enough from version 1.0 hak files that I cannot find a method to first segregate the files and then attempt decryption. They are NOT compressed though, so that should make decryption easier. I know at least one person has had success with decryption, but will not share the method details (and I totally understand why).