That is not entirely true. Perhaps in the stated configuration it is, but since the domain points to the EC2 instance, you could always register a new LetsEncrypt certificate for it, and do a silent MITM.

Perhaps the architecture you describe is the best, however I would hope for two things to be supported: 1) The ability to run your own gateway server instead of having to trust one managed by your company. 2) The ability to disable the gateway entirely if you happen to have a business connection already.