You're correct. Let's illustrate it with a few facts.
Section D of RFC2328 states clearly that all OSPF protocol exchanges are authenticated. The AuType field is included in all OSPF packet types (this is important):
All OSPF protocol exchanges are authenticated. The OSPF packet
header (see Section A.3.1) includes an authentication type field,
and 64-bits of data for use by the appropriate authentication scheme
(determined by the type field).
It also lays out the types of authentication, even though "Null authentication" means no authentication, it still signals that to the neighbor.
0 Null authentication
1 Simple password
2 Cryptographic authentication
All others Reserved for assignment by the
Table 20: OSPF authentication types.
RFC5613 specifies that the L-bit can only be set in Hello and DD packets and NOT other packet types...
The LLS block MAY be attached to OSPF Hello and Database Description
(DD) packets. The LLS block MUST NOT be attached to any other OSPF
packet types on generation and MUST be ignored on reception.
...if "cryptographic authentication" (AuType 2) is enabled:
This TLV MUST only be
included in the LLS block when cryptographic authentication is
enabled on the corresponding interface.
Furthermore, it states how the authentication should be handled.
Note that if the OSPF packet is cryptographically authenticated, the
LLS data block MUST also be cryptographically authenticated.