Yep that’s true. Working on a service that will notify users of payments through DMs.
The core concept of npub.cash is cryptography based on nostr / schnorr signatures. It is in its nature that every profile has a payable address without opting in to it