It does include "has_secure_password" and its friends (password/password_confirmation) though, which goes a ways towards including auth/authz even if one doesn't use devise, when coupled with before_action-s. It certainly comes with some facilities for getting off the ground:
https://api.rubyonrails.org/classes/ActiveModel/SecurePasswo...
Devise does a great job of it though - https://github.com/plataformatec/devise