That's what I thought based on what I've read so far, thanks for confirming.
Unless and until that's fixed, if I finally see enough value in joining Mastodon, I will have to do so using my own server where I have full access to all my content.
It's particularly idiotic because the Activities in the export are all signed, so an importing server just need to do a webfinger and profile lookup, and can then validate all of the posts. Of course you can still fake them, but if you show a "moved from <origin instance>" on them, that's really all you need to do - moves from, say, mastodon.social would be trustworthy, moves from some small instance would not.
But even that can be fixed with tamper proof timestamps and signing the whole archive, and in any case you can validate this against the public API because it remains accessible on the origin server (at least for some time after the initial move, I don't know how long).