The main reason for FileVault is to protect your personal data should your Mac be lost or stolen.
Login passwords and other operating systems protections work to prevent access by anyone that does not have physical possession of your Mac.
But before FileVault someone with physical access to your Mac could have disassembled your Mac, removed the storage, and used another computer to read your data.
FileVault means even physical access will not allow anyone to read your data.
The encryption/decryption is all done by hardware, so there is no, zero, zilch performance penalty.
As has been mentioned the M-series Macs always encrypt the internal storage. But they do not password protected the encryption keys unless you enable FileVault. Although it seems macOS Tahoe 26 puts the encryption keys under your macOS account password.
External storage is not automatically affected by FileVault. You may use FileVault to encrypt external storage if you desire. Again, it is protection against the external storage being lost or stolen.
iCloud is never covered by FileVault. As data moves over the network between your Mac and iCloud it is protected from interception, but once it reaches the end-point, it is decrypted and stored. Like using an armored truck to move the data, but once it is at the other end it is taken out of the armored truck.
If you want to store encrypted data in iCloud (or any vendor’s cloud storage), you need to encrypt it manually with an encryption utility before sending it over the internet, and use the same encryption utility to decrypt it when you transfer the file back. This is outside the scope of FileVault.
NOTE: Apple works hard to make sure only you are allowed to access your iCloud data, but if a government provides a court, Apple must comply and allow access. Data you did not manually encrypt locally with an encryption utility before storing it in iCloud would be readable to court ordered access.
