"Six months ago, chances of getting a new Mac with a T2 chip were slim: only if you surrendered a lot of money to an iMac Pro, would you get one," writes Howard Noakley for Eclectic Light Company. "Now most new Macs are equipped with a T2 – MacBook Air, MacBook Pro with Touch Bar, Mac Mini, and of course iMac Pro."
"You see no difference," writes Noakley. "There is no splash screen to say that your Mac has a T2, and in normal use, there is nothing noticeably different. But start up in recovery mode, try installing Linux using Boot Camp, or try to boot from an external drive , and T2 will make its presence blank. "
" By default, even if you did not select the boot disk that should be encrypted using FileVault when you first enter your new Mac, your boot disk will still be encrypted by T2, and your Mac will be put in full security mode, with boot from external media disabled, writes noakley. "This may seem strange, but it does not seem possible to get a Mac with a T2 chip to boot from an unencrypted internal drive: That disk will always be encrypted, regardless of whether you turn FileVault on or off. The difference it does is that if you choose FileVault to be "off", the encryption will be locked using only the internal hardware UID (held in T2's Secure Enclave), and will not use your password as well.