Mostly correct.

I had tokens stolen from a wallet using a fairly obtuse scheme involving ERC-20 token approval and a proxy contract. This is required for almost all DEX users, and really is a weakness of the EVM in that it restricts user transactions to single contract calls rather than sequences like smart contract internal transactions. There are ugly, insecure, incompatible, and expensive workarounds like smart contract wallets and exploding contract deployments. I guess I should probably raise an EIP to make this sane.