It is indeed true (and complicated). There have been well-publicized cases of users who have been permanently locked out of their account, because they lost all their trusted devices and also their recovery key.