Add clarification on behaviour in absence of policy (#4354) (#4631)

* Add clarification on behaviour in absence of policy

* Content fixes for clarity

* Remove example manifest in favor of explanation

The example manifest was confusing because it wasn't technically valid
if applied to a cluster. This removes it in favor of just spelling out
that both origin and transport auth are disabled.

(cherry picked from commit bb8af722b2)

content/docs/concepts/security/index.md

@@ -456,6 +456,9 @@ only one authentication policy per mesh and one authentication policy per
 namespace. Istio also requires mesh-wide and namespace-wide policies to have
 the specific name `default`.
 
+If a service has no matching policies, both transport authentication and
+origin authentication are disabled.
+
 #### Transport authentication
 
 The `peers:` section defines the authentication methods and associated