Your first assumption is correct. The funds are received and held by the user‘s liquid wallet on their phone. There is no lightning node on the device, so no need to manage inbound liquidity. Boltz handles all of that.