yes this is 100% the case.
ecash is just a blind signature that can be issued and verified by the mint
there is no ledger or independent way to audit the supply of these signatures
You can audit. It's not 100% verifiable, but it can help catch fishy behavior. A lot of free baking theory and competitive banking/hedge funds come into the equation.
Also programmatic bank runs and scheduled expirations help this.