That's only true if they observe the channel being fraudulently closed in the right time window. You have to actively monitor the BTC chain to see if your Lightning network partner might steal from you. If you don't (e.g. There is some network or power issue and they take this opportunity to steal), tough luck.

Basically Lightning is like a tab that you open in a bar. You perform various transactions on the tab, and only settle later. No one would say that you're using Visa when you tell the bartender to put some drink on your tab, even though at the end of the day or week or whatever, the transaction will go through Visa.