That is correct. Flows that use a manual (instant) trigger run under the security context of the person who triggers the flow, so they need to have a premium license.
Automated and recurrence triggered flows run in the security context of the maker. So they are the only one who needs a premium license.
The one exception is multiplexing. Where a flow has been designed with an automated trigger specifically to avoid licensing costs. In that case all the users still need to have premium license although the system will not enforce that.
