Well, I'm facing a very similar scenario, for a specific channel, I have two services: the first one is HD, with the highest priority, the second one is SD. The first one is also encrypted during the night, not the second one.
My issue is that, when trying to watch this channel during the night, tvheadend keeps streming the first one, which is encrypted. Is there a way to force tvheadend to use another service when encrypted i.e. treat this service as "not available" ?