Yes, everything you say is correct, at least with Desire2Learn at PCC. We discovered this too. A D2L user with the ability to create an External Learning Tool link could technically create one pointing to webwork course X, even if that D2L user has nothing to do with webwork course X. Then that person or any student in the D2L course where the ELT link was created could enter webwork course X as a student.
Here is why we are not too concerned.
Only D2L users with the ability to create External Learning Tools links could do this. Doing so intentionally would violate policy, and if the instructor of course X cared, the violator would be in serious trouble.
Doing so accidentally is unlikely to happen. If it does, it temporarily mucks up instructor X's grade book, which is not a big deal in the scheme of things. It also could mean the offending instructor's students might do work in the wrong webwork course. The offending instructor would be on the hook to make that right.
So far (after two years of LTI use) it hasn't happened.