You are mostly correct. Except only your Bitcoin client sees the checksum/address, the raw transaction has just the pubkey hash encoded in the address. So there is no checksum for other nodes to check. If you accidentally crafted a transaction with the wrong hash in the scriptPubKey, the network would happily accept it.