Yes all correct. What your missing is thatb once it is schedule 2 there is no such thing as a legit supplier in MMj state. Its an FDA regulated drug and they are all non compliant.
There is no such thing as a legit MMJ supplier right now, according to federal law. No one is compliant right now. Schedule 1 laws are more restrictive than schedule 2 laws. The DEA is worse than the FDA. It's up to the president (and lately congress) to allow federal agencies to enforce federal marijuana laws over state laws.
Schedule 2 is a step in the right direction. I could see pharm drugs like Sativex remaining schedule 2 while the actual plant is legalized medically and recreationally. The people of the US support legalization now. There's no going back. It will just take the federal government a little time to catch up to the will of the people.