Can an S2 Z-Wave repeating device still repeat secure messages after failing S2 secure enrollment?

Yes. If an S2 repeating device fails secure enrollment, it will still be able to repeat S2 or S0 encrypted messages for other devices. 

If a light, thermostat, repeater, or any other non-access point Z-Wave device has failed secure enrollment, it is not critical to re-enroll with the aim of it completing secure enrollment.

If the Z-Wave device serves as an access point (e.g., a Linear GD00Z Garage Controller) and it fails S0 or S2 secure enrollment, it must be deleted and re-enrolled securely in order to respond to commands. For more information about secure enrollment failure, see Z-Wave device is not completing secure enrollment.