That is correct. The replication of the “Holded Object” variable in your blueprint won’t actually affect the mesh at all. This variable is only storing a reference to that Static Mesh actor, not the asset itself. This variable also doesn’t need to be replicated as the Attach function (where it is created) and the Detach function (where it is used and cleared) are both called on the server.
Replicates movement is a setting directly on the Static Mesh actor itself and will cause it to replicate across to clients.
One easy way to look at this from a networking perspective is that the client doesn’t need to know that the static mesh is attached to anything (unless you also need to stop the client from attaching that mesh to itself while the server has it attached), it only needs to know that it is moving.