That’s right. There’s no way to steal from you unless you somehow are unable to go online to publish your unilateral redeem transaction.

Of course, in some nightmare scenario where the asp is also 51% of the hashrate, they can steal (by censoring your redeem transaction). This is also true in lightning though, if your channel counterparty happens to also have 51% of the hashrate.