PostgreSQL - SSL connection without providing the root-ca certificate?
In the absence of PGSSLROOTCERT or sslrootcert, the library libpq (which psql uses) looks in a compiled-in default location for the file.  And apparently, it finds it at that location.

For Linux, that location is ~/.postgresql/root.crt.  Although it is possible that "Debian 10.3-1.pgdg90+1" patched it to look someplace else instead.