[iluxonchik]

This is not true. The client can simply skip the certificate verification, making the connection unauthenticated. Raw Public Keys (which are basically simplified X.509 certificates), can also lead to unauthenticated connections.

In fact, Appendix C5[1] reads:

   Previous versions of TLS offered explicitly unauthenticated cipher
   suites based on anonymous Diffie-Hellman.  These modes have been
   deprecated in TLS 1.3.  However, it is still possible to negotiate
   parameters that do not provide verifiable server authentication by
   several methods, including:

   -  Raw public keys [RFC7250].

   -  Using a public key contained in a certificate but without
      validation of the certificate chain or any of its contents.

[1] https://tools.ietf.org/html/draft-ietf-tls-tls13-28#appendix...