The upgrade to TLS was refused
The receiver refused or failed the STARTTLS command.
In detail
Distinct from handshake: this is the refusal of the command, that is the failure of the negotiation. Both only end delivery under a strict security mode; under the default the engine carries on unencrypted and counts it as "not secure" instead.