The Bluesky app view is centralized in that it can decide which content to show, but A) the hosting of that content is decentralized, and B) alternate app views like Blacksky exist which are fully independent of Bluesky (both Bluesky the company and Bluesky the app view). The Bluesky app view could stop showing users content from Blacksky (or any other) PDSes, but that's it. If you're using the Blacksky app view, afaik Bluesky the company can't do anything other than cut you off from Bluesky's PDSes.
ATProto would need to use signing key cryptography and content addressable storage to be distributed. If we can't store our data with third parties or create an offline-first system then it's not a decentralized social network.
If by "decentralised" you mean "0.001% of it is not only hosted centrally"
They have designed a protocol that could theoretically be decentralised. Then reality hit, and it was centralised.