IPFS is "truly decentralized" in the sense I think you mean. The publisher runs the origin node. It's the http gateway that isn't. Except it kind of is in that you can use any IPFS http gateway. Ideally clients would use native IPFS, not http, but turnkey native client support in browsers is not here today.