Yes, correct. smtpd is enabled on localhost for local users only. This is pretty common on most systems, AFAIK Debain uses exim4.