macOS has encrypted the system partition since the T2 chip was introduced. Older hardware doesn’t do encryption by default, but you’ll need a device over seven years old for it not to come with encryption by default.