Yes, there are relays to connect the clients together and then the transfer is direct.
Several years ago when I was doing consulting I had lots of clients that blocked all the normal file sharing domains to prevent people from getting files into servers but magic wormhole always worked for me. I'd stash a wormhole-william (magic wormhole compatible Go application) executable in our installer deliverable and then I could update the software without IT's help in the future (I often had RDP access). The headaches saved by cutting red tape were worth the risk for me.
I run truenas scale and it's great and pretty much set and forget. I have a bunch of NFS shares and run minio for services that support object storage. I also run postgres, mariadb, and mongodb so that I don't have to worry about how big databases get on my compute machines.
The truenas container features are fine but I prefer to run most containers on dedicated docker hosts.