FileVault encryption is on by default. The encryption key is derived from the login password and the login screen has delays to avoid brute-forcing the password.

Additionally, data in the flash chips are always encrypted by the unique key burned in the M chip (previously T2 secure enclave).