You really don't want to use ChaCha20 alone in any situation.

What ChaCha20 does for you is to prevent attackers from reading your data, which is good. But ChaCha is a so-called stream cipher which works by XOR'ing a pseudorandom pad with the message (your file at rest).

If an adversary now gets hands-on your drive / file he can mainpulate the file. For example assume it's your next day's financial transaction plan. An attacker who knows where the bank ID of the receiver lies and knows who should receive the transaction can flip the bits at that position in a way that his bank account is the target.

Poly1305 is designed to prevent this kind of attack by assuring that the data hasn't changed without knowledge of the key. Assuming the key for Poly1305 is unknown to the attacker he can't correctly update the authentication tag. If he now changes a single bit of the cipher text the verification will fail and you'll notice that somebody has changed your file, protecting you from a malformed operation ( / transaction).

TL;DR: ChaCha20 protects your file from being read, but not from being manipulated, which may easily cause severe attacks. So you really want to use Poly1305 in addition to ChaCha20.

You really don't want to use ChaCha20 alone in (nearly) any situation.

What ChaCha20 does for you is to prevent attackers from (passively) reading your data, which is good. But ChaCha is a so-called stream cipher which works by XOR'ing a pseudorandom pad with the message (your file at rest). However it is for this very way of working that ChaCha doesn't prevent attackers from (actively) reading your data if you allow them to decrypt anything but the stored cipher text.

If an adversary now gets hands-on your drive / file he can manipulate the file. For example assume it's your next day's financial transaction plan. An attacker who knows where the account ID of the receiver lies and knows who should receive the transaction can flip the bits at that position in a way that his bank account is the target.

Poly1305 is designed to prevent this kind of attack by assuring that the data hasn't changed without knowledge of the key. Assuming the key for Poly1305 is unknown to the attacker he can't correctly update the authentication tag. If he now changes a single bit of the cipher text the verification will fail and you'll notice that somebody has changed your file, protecting you from a malformed operation ( / transaction).

TL;DR: ChaCha20 protects your file from being (passively) read, but not from being manipulated, which may easily cause severe attacks. So you really want to use Poly1305 in addition to ChaCha20.