Copying data in recovery mode - is this a security flaw? My Mac crashed, operating system error, tried reinstalling OS, no luck.... anyway I need to do a fresh install so I am copying my data off the machine using command line and recovery mode.

My question is, I've copied the data without any issues, but isn't this a security flaw?

What's to stop me going to someone's Mac, starting recovery mode, open terminal, go to the Users or a user directory and copy off whatever I want?
That is what Filevault is for.

If a bad actor has your computer in their hands you need encryption to keep them out. No encryption, no security.

Even if you have the computer firmware password protected, that wouldn't prevent them removing the drive to access from another machine.