You are partially correct.
The intial Trusted Setup is required to produce the CRS or Common Reference Strings that produce the two Public proving keys to be used for verifying transactions. The CRS contains a secret backdoor that must be destroyed.
If the Trusted Setup is somehow compromised by a malicious party they could theoretically forge currency, but it would not compromise anonymity of transactions.
See this thread for the whitepaper and discussion: Is there a whitepaper? - #9 by paragonie_scott