default encryption between ALB and target groups.

If strict encryption of communication is required by PCI SSC requirements, etc., the communication between ALB and EC2 may also be HTTPS.

The link you posted does say this, it is physical layer encryption (layer1) and not layer7 (TLS) therefore although there are native mechanisms for authentication etc (see the highlighted paragraph, note that it says authentication and not encryption) it is recommended to use self-signed certs to encrypt the traffic between ELB and targets if you are looking to achieve end-to-end encryption.

All network traffic between AWS data centers is transparently encrypted at the physical layer

Please see this link which has specific recommendations for the customers: Data protection in Elastic Load Balancing

Also, the below paragraph:

The load balancer establishes TLS connections with the targets using certificates that you install on the targets. The load balancer does not validate these certificates. Therefore, you can use self-signed certificates or certificates that have expired. Because the load balancer is in a virtual private cloud (VPC), traffic between the load balancer and the targets is authenticated at the packet level, so it is not at risk of man-in-the-middle attacks or spoofing even if the certificates on the targets are not valid (1).

Reference:

[1] https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#target-group-protocol-version