It's not (or at least, not exactly in those terms).
On startup, if you have not performed any security configuration, elasticsearch will auto configure security and write an updated elasticsearch.yml that turns on SSL for transport and http.
You can disable this by either:
- setting
xpack.security.autoconfiguration.enabledtofalse - configuring some part of security yourself (which can be as simple as setting
xpack.security.enabledtotrue).