How can I arrange for Exim to advertise support for SMTP authentication only when the session is encrypted?

Use this setting:

auth_advertise_hosts = ${if eq{$tls_cipher}{}{}{*}}