The point I am making is that pg_basebackup is connecting without encryption and I want to know how to tell it to use encryption. The docs are silent on the subject.
It is a client application that talks libpq. All of them understand a common set of environment variables:
Many of those can also be supplied as part of the connection string. These include SSL mode control.
The question I would ask is whether psql connects by default using ssl in the same basic configuration. If so, then the inconsistency amounts to pg_basebackup having an insecure default connection method while psql has a secure one.