Question regarding how Mac Security works with FileVault off
Every file is protected by permissions. Permissions are like laws: You can choose to follow them or not. Files are like property.

Laws:


John owns this file and controls who and what people can do 
Bob, Johns friend,  can Read this file but can't Write to this file
Sam, Johns colleague, can read and write to this file
Everyone else is unable to read or write to this file


Note:  You can see these permissions by selecting a file and pressing CMD + I. Under "Sharing &amp; Permission" there is a list of users and there corresponding permissions.

It is up to the operating system/user to follow these laws (permissions).  

Jack, Johns enemy, can look at the file and see that he does not have permission by John, the owner, to view this file.  Jack is a bad guy and decides that he is going to look at the file anyway.

Jack can do this extremely easily by booting onto a flashdrive/external drive and following this guide: https://larryjordan.com/articles/mac-os-set-hard-drive-permissions/ or some many other various ways including booting from an external drive.

Scenario 1: The File is not Encrypted

Jack views the file and steals all the information on it.

Scenario 2: The File is Encrypted

Jack tries to view the file but the file is unreadable because it is encrypted. Jack yells "DARN!" in frustration and continues on to his next victim.

Scenario 3: The File is Encrypted but John Uses an easy to guess password
Jack tries to view the file but the files is unreadable because it is encrypted. He decides to see if he can guess John's password and guesses "John123". Jack is correct and unencrypted the file. He yells "Stupid John" and steals all the information on it.

Moral of the story:

Permissions are like laws.  Most law abiding operating systems and users will...well..abide by these laws. But some criminals (hackers or your average Joe) can very easily ignore these permissions.  To prevent these people from accessing your information you have to encrypt the file with a strong password, otherwise the criminals can guess/brute force/hack the password and access your data.

FireVault encrypts your entire disk. I would suggest keeping it on if you have any important information on your disk.