Problem is that touching a large number of files is going to be slow. And since you have to compare it to the previous version to see if there are any changes, this is essentially the work that the backup process does anyway.
If the goal is simply encryption detection, it would be likely that most files have their size changed. This will happen because encryption is working with fixed-size blocks, and will pad the input data to fit the block-size and write the entire block back. This check is faster but you still need to touch many files in advance and look up their previous size.
Another approach could be to stop the backup once the threshold is exceeded and mark the backup “bad” somehow, so no new backups will run (should be manually clearable for false positives).
A different option could be using the Duplicati Portal, which includes anomaly detection for file changes and can alert you if the threshold has been exceeded. It is a little rough in the current version, so you cannot set the threshold, but for your case it should work.