Correct, messages aren’t E2E encrypted if the push has the data.

If there’s any reason to preserve privacy the push only has an identifier of the message to be downloaded on the device. When it comes in, the device downloads it and then if you’ve allowed it, will show it on a notification