Macs with a T2 chip always encrypt their drives. Why is FileVault necessary?
Newer Macs come with a T2 Security Chip with its own Secure Enclave, a tamper-resistent bit of silicon that allows high levels of security just like on an iPhone and iPad. It’s used to enable Touch ID and allow Apple Pay on laptops, but it also handles a number of other tasks, including full-disk encryption. (The T2 chip began appearing in Macs with the iMac Pro in very late 2017; see this list to check if you’re not sure if yours is one of them.)
On pre-T2 models, macOS uses a combination of software and hardware-accelerated encryption to encrypt all the data on your disk using FileVault, which can be turned on and off via the Security & Privacy preference pane’s FileVault tab. It can take an extremely long time for FileVault to encrypt a drive completely the first time on these older Macs and bog down a system while it is underway. Afterwards, Macs generally handle live reading and writing at almost the same speed as if the data weren’t encrypted.
FileVault prevents the data on a disk at rest—not powered up and logged in—from being extractable in any effective way. The data is just a bunch of digital garbage without access to the key, and the key can’t be retrieved without the password of one of the FileVault-linked accounts on the Mac, which has to be entered at startup time to unlock the drive.
Read more at MacWorld.com