Does having a Mac with a T2 chip automatically prevent someone from booting into Recovery mode or Target Disk Mode or from accessing disk utility or a terminal without having a user's password credential?
Finally, are there any stipulations associated with having FileVault turned on or off on Mac with the T2 chip, with respect to booting the device into something like Target Disk Mode?
The point from what I can see is having the data encrypted is more about making it so much easier to wipe and encrypt when people want to.
The device will share the contents of the drive with anyone without a password until you enable FileVault. However, you can't take the storage out of one Mac and read it in another - so that's the primary benefit for having everything encrypted on an individual key that's locked in the Secure Enclave.
When you choose to make the Mac secure - it's instantly fully secure now and can't fail to "encrypt" the whole drive once you start the encryption.
Apple documents "the point" of their defense in depth approach to security. There are quite a few layers and systems that work together. The whole guide will take a while to digest, but skim it for parts that interest you and go back.
