You got everything right except the encrypted part. The files stored on blossom servers is not encrypted
The media are usually hosted on external sites i.e. nostr.build or satellite.earth
Or some clients like Primal offer their own media hosting within the client
I think by default nostr relays only contain text, but there are technologies being worked on like Blossom which, as I understand, is basically like nostr relays but for (encrypted) media.
PS I'm not very technical so I might off here somewhere 🙃 If I'm wrong anywhere then hopefully some more code-literate persons such as nostr:nprofile1qqsrhuxx8l9ex335q7he0f09aej04zpazpl0ne2cgukyawd24mayt8gprfmhxue69uhhq7tjv9kkjepwve5kzar2v9nzucm0d5hszxmhwden5te0wfjkccte9emk2um5v4exucn5vvhxxmmd9uq3xamnwvaz7tmhda6zuat50phjummwv5hsx7c9z9, nostr:nprofile1qqszv6q4uryjzr06xfxxew34wwc5hmjfmfpqn229d72gfegsdn2q3fgpz9mhxue69uhkummnw3ezuamfdejj7qgjwaehxw309ahx7um5wf6k2tnrdakj7qg6waehxw309ac8junpd45kgtnxd9shg6npvchxxmmd9usc5pxf, nostr:nprofile1qqsdv8emcke7k3qqaldwv956tstu40ejg663gdsaayuuujs6pknw7jspz3mhxue69uhhyetvv9ujucn0w3jhvtnnwcq3yamnwvaz7tmsw4e8qmr9wpskwtn9wvqs6amnwvaz7tmwdaejumr0dsx2l4qj, nostr:nprofile1qqsyvrp9u6p0mfur9dfdru3d853tx9mdjuhkphxuxgfwmryja7zsvhqpzamhxue69uhhv6t5daezumn0wd68yvfwvdhk6tcpz9mhxue69uhkummnw3ezuamfdejj7qgwwaehxw309ahx7uewd3hkctcscpyug or nostr:nprofile1qqsglv2qkn5dmmuhee9cy8fywfu2rfp4xd3xy0myqg2gfvmjl9yqqrqppamhxue69uhk2tnwdaejumr0dsq3qamnwvaz7tmwdaehgu3wwa5kuegpr3mhxue69uhhxun5wfjkccte9e3j6um5v4kxcctj9ehx2aqwxwwwh can correct me :)
Discussion
Clients (like ours) can and do encrypt content before pushing to blossom though