Caveat: I’ve used LUKS quite a bit, but never to do exactly what you’re trying to do, so the following is a guess.
If the root disk was the encrypted one, the tooling would add scripts to your initramfs to handle the prompting and unlocking at boot.
Since it’s not the root, those scripts may not be getting added.
I’m not sure about the “right” way to force it to add them, but you should be able to manually tweak your initramfs setup to add them.
What’s better depends on your threat model and tolerance for inconvenience.
Personally, I prefer a hardware security token PLUS a lengthy and complex passphrase (both required to unlock). That way someone can’t access my system simply by stealing my hardware token.