Do all games have to be rated by the ESRB?

No. Submitting a game for an ESRB rating is voluntary. It is not illegal to sell unrated games. It's not even 'illegal' to sell an M-rated game to a minor, though it may violate a company's policy and a sales rep could be penalised for it.

However, most major game chains in the US and Canada refuse to stock unrated games, and rating might also be a contractual obligation say for a third party producing a game for a specific platform.

As for digital only games, it depends on how you distribute it. If you are wanting to use a distribution platform like Steam, all of these will require that the game is rated for each relevant territory, so ESRB, PEGI, etc.
If you're just selling it on your own website, then again there's no obligation. So for example Minecraft has an ESRB rating of E for the XBox360 version due to whatever requirements Microsoft has in place. However the PC version is unrated because there's no requirement to do so, and they sell exclusively through their own web store.