That's correct. It's encrypted in transit, but the endpoint bridges decrypt messages then reencrypt them. IIRC you can run the bridges yourself on your own servers - Element just offers this service as well.