That's right.

I suppose given the login URL that Amber generates is your npub along with a Bunker nsec relay, it uses the two, so when noStrudel needs to sign something, it calls Amber on Android via the relay+npub, and Amber notifies you to allow/disallow as/when required.