You have nailed it. Bluesky weirdly tries to omit that as much as they can, but they do admit in their protocol descriptions that everything goes through and depends on a central server with absolute power.

They also mention that anyone can run another of these, but there is zero chance anyone will be able to do that.