Yes, it is purely a security measure to prevent even momentary unauthorized access. If a hostile party on the same machine knows you are in the process of setting up a new cluster, they could easily test in a loop for it to become connectable with trust authentication. So even if you leave it open for just a few seconds, it could be exploited in that time.
If you start the server first and then edit pg_hba.conf to make it more secure but then forget to do a
pg_ctl reload or equivalent, it will remain vulnerable. If you do do a reload, existing exploit connections will remain live even though new ones can't be made. If you do a
pg_ctl restart or equivalent, existing exploit connections will be severed. But it only takes a few milliseconds to do serious damage. For example, they could create a new postgres superuser account with a password of their choosing. Or they can perhaps leverage the existing default PostgreSQL superuser account to manipulate the home directory of the OS user running the PostgreSQL server in arbitrary ways. Including things like adding an entry to