Basically, yeah, although "insecure" is a bit too broad; unauthenticated encryption is insecure in some contexts, like sending messages to another person. But if you're encrypting your own backups, and all you care about is that the NSA can't see what you're storing, then there's no insecurity: encryption alone is sufficient.

By the same token, sometimes authentication alone is sufficient, like if you just want to verify that some person did indeed "authorize" a particular message -- for example, a public forum post with an attached PGP signature.