That's absolutely correct. Everyone seems to fixate on the encryption, but hackers are lazy and they'll attack whatever is weakest. In this case that means the storage on the phone after it's decrypted.

Don't store classified information on your phone, regardless of what you use to transmit it.