Yes, that is a configuration that you should generally avoid outside of very limited special cases:
Allow the connection unconditionally.
This method allows anyone that can connect to the PostgreSQL database server to login as any PostgreSQL user they wish, without the need for a password or any
trust authentication is only suitable for TCP/IP connections if you trust every user on every machine that is allowed to connect to the server by the pg_hba.conf lines that specify trust. It is seldom reasonable to use trust for any TCP/IP connections other than those from localhost (127.0.0.1).
Note that allowing connections without providing any password may already be the case, as many distributions default to authenticating connections via unix sockets as the connecting user. That would typically result in the
www-data system user being able to use the
www-data postgres user without a password. Check the rest of your authentication configuration to see if this is the case.
Recommendation: Provision password or certificate authentication, do not proceed with the
Note also that limiting something to loopback addresses only is generally not sufficiently secure guarantee against external access. There is a long history of loopback-bound services being accessed through other software acting as an unintended proxy.