Help understanding the password file
The password file is an option for authenticating remote users with special privileges. A database can operate without a password file. So no, it is not mandatory.

Typically all databases have their own seperate password file. If you create the new database with DBCA, that automatically creates the password file for the new database.

Some companies simply do not create password files for their databases and disable password file authentication in order to lower security risks. Think of it as disabling root login through SSH.

Features like Data Guard rely on password file authentication. You can create the password time now or later, it is up to you.