There should be option that would require encrypted connections to Zabbix server and Zabbix proxy trapper port, all unencrypted connections must be dropped immediately when detected that there will be no handshake.

Whitelist for unencrypted connections could remain as StatsAllowedIP=127.0.0.1
If StatsAllowedIP=127.0.0.1 is commented out then no unencrypted connection should be allowed