Yes, this is correct. I thought BC.i "fixed" this by having a browser extension you could download though. Of course, that only complicates matters because then every time they update then you want to download a new browser extension.
This is why I was kind of interested in what Sirius is working on. If he could make an independent audit server that random folks could run to verify each others sites, we'd have a "community of consensus" that we're all running code each of us has actually written.