It's a similar story with LDAPS, in that LDAP+TLS starts off on a plain text connection to negotiate TLS, and it can be all the same port 389 (can be different port 636 too). You might be able to query too much info from a poorly configured LDAP server if it downgrades or sustains that TLS-less connection.

You still see people and software libraries preferring LDAP+SSL on the dedicated SSL port 636 even though the LDAPS+TLS is suppose to be the "modern" method and apart of the LDAP spec.