Yes, you have to include what you use. It's not mandated that standard headers include one another (with a few exceptions IIRC). It might work now, but might fail on a different compiler.
In your case, apparently <iostream>
includes <string>
, directly or indirectly, but don't rely on it.
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…