Yes, making the bombs themselves seems to be easy. The difficulty comes from U232-contamination which decays into strong gamma emitters, making handling difficult. However, there seem to be paths for the production of pure U233 from chemically separated Pa233, which one might be doing anyways in a thorium reactor. That would mean a significantly higher proliferation risk, because one would get pure bomb fuel form the normal operations of the reactor. However, I don't know enough about how easy or likely that would be to judge.

But in all, you are right, I think. And maybe even more than right.