Yes, exactly. This is why real-world systems additionally include some kind of authentication protocol.

Reference: https://en.wikipedia.org/wiki/Man-in-the-middle_attack#Authe...