In essence, yes. The server checks whether it can trust the client at
mount time. From then on, the client's operatings system is trusted
when it passes information.
If the user on the client machine can make up file handles, she can
also make up user ids. Since the user credentials are trusted as well,
you don't need to hack file handles if you operate a corrupted
machine.
Regards,
Martin