wallet-unenc-backup contains the backups that were created before you set a password. Since MultiBit creates a backup each time it adds a key, and it doesn't seem possible for a wallet to be encrypted from the start (before the first key is added), there will always be at least one of these. Once the wallet is encrypted, no further backups will go here. You can verify this by checking the timestamps.

As Jim says, MultiBit goes back and encrypts these old backups when you first set a password, but note that it's a different method of encryption from the regular wallet, hence the .cipher extension. A regular .wallet is a protobuf file (serialization of Java objects), inside which the public keys are stored in cleartext and private keys are encrypted individually. Whereas the .cipher is a custom format that encrypts the previous file's contents as a whole. (I assume they did it this way to avoid messing with old backups any more than strictly necessary.) I was mystified like you, so I found the format in the source:

// The format of the encrypted data is:
// 7 magic bytes 'mendoza' in ASCII.
// 1 byte version number of format - initially set to 0
// 8 bytes salt
// 16 bytes iv
// rest of file is the encrypted byte data

Then there's yet a third encryption format for exported private keys: http://test.multibit.org/en/help/v0.5/help_exportingPrivateKeys.html. My preference is to delete the "unenc" stuff, as it's an unneeded extra copy of sensitive information that just adds confusion. (Needless to say, don't delete any wallet related files unless you know exactly what you're doing!)