Correct. The trade-off here is on Bluesky you can delete or re-order your posts which you cannot do on a network with strict message ordering. Your PDS webmaster can also rewrite your messages for you if they become unhappy with your messaging.
That said, the PDS is effectively also your private key custodian. Most people who aren't nerds are happy to let Bluesky PBC manage their keys. But if that's your threat model, you should absolutely move to a self-managed PDS.
The protocol also actually allows you to manage your keys differently. You could in theory have a "read-only" PDS, and generate all your posts locally using a local key (conceptually much closer to a crypto wallet.)
In that scenario, the validity of posts as originating from a known identity is extremely strong.
There's ways around it... the identity mechanism supports multiple keys so you could have a backup in escrow.
But most people don't want to worry about key management at that level. Hell, I know exactly how everything works, and key management still scares me. The consequences of a mistake are huge.
Edit: or we could backup the key.
The PLC registry supports an override key for adversarial migrations, which was our chosen alternative
I'll look into the registry override too, maybe I can hack something together around that.
The fact it's a subkey means that you are also able to rotate the key that the PDS has access to and modify your repo back to pre-defaced state if need be.
Imagine if Github worked this way, then I wouldn't have to worry about storing my ssh keys on my local machine. Imagine the possibilities if Github could pull my repo instead of me having to go through all that darned trouble of pushing it.