The entire second paragraph addresses the internal security beyond the SSL protection used in transit. But yes, in effect, SSL is the only thing protecting the

The entire second paragraph addresses the internal security beyond the SSL protection used in transit. But yes, in effect, SSL is the only thing protecting the user's password on the wire and this password is what is used to generate the master key for the encrypting the messages server side.