Yes, for the most part both Amazon and Google require that the Hardware vendor run a service that supports their specific API that the Voice Assistant systems can call.
For Amazon you have to provide a AWS Lambda function as the interface and Google require a HTTP API endpoint.
There are some exceptions to these rules, e.g. Amazon support direct control of Belkin WeMo devices, but I believe they are removing this capability and migrating over to the same system of making an API call.
The other standard is ZigBee lights, with some Alexa devices having built in ZigBee radios providing direct control.
Google devices tend to support the Thread system (since this was what NEST used before Goolge bought them)
Google also support something called their Local Control SDK which allow the direct control from the local Google Home device directly to the device, but this still requires the cloud service as both a back up command route and device discovery and state are still all done via the vendors cloud service.
It's also worth pointing out that the Hardware vendors also want to run their own systems a lot of the time. It allows them to gather all sorts of useful data about how customers use their hardware (e.g. if features are actually getting used or not) and to do fault/failure analysis. Neither Amazon or Google will let them see any of that data.
Apple's Homekit system is the exception in that all control is local and each device has to be locally discoverable and controllable by implementing Apples API on your local network.
Things are starting to change as there is now a consortium made up of Amazon, Apple, Google and a bunch of IoT device manufactures to try and build a standard control protocol for doing local control. (https://www.theverge.com/2019/12/18/21027890/apple-google-amazon-smart-home-standard-zigbee-connected-ip-project)