When you install a RDBMS (say, PostgreSQL) and create a database, without taking any additional steps, what can you assume about the security/confidentiality of the data? I mean, is it encrypted by default, so even a person with physical access to the machine (or root password to the OS) would have trouble accessing it without the superuser credentials? Are the credentials (or some easily crackable equivalent) stored somewhere, like in a file?

Sorry if that sounds obvious, but for me it's not. Searching for "database encryption" yields many results about how to encrypt a database, what use cases it's good for, etc, but doesn't answer my basic question. For an ordinary, no special needs scenario (who has the password accesses the data, who hasn't doesn't), do I have to take additional steps for securing my data?

Contrast that question to OS filesystems and Truecrypt: for the former, it's obvious that nothing is confidential at all, you must use full-disk encryption to protect your data; for the latter, it's easy to see the credentials are not stored anywhere, if you don't have the password/keyfile the data in front of you is useless. What assumptions can I make about RDBMS (at least the most common, production-oriented ones)?