Yup, you've got the idea. Your last paragraph beginning "However what I understand..." captures the idea well. That's about right.
Attack trees are one possible tool that to assist with what is sometimes known as "architectural risk analysis" (Microsoft calls this "threat modelling"; two names, same idea). The idea of architectural risk analysis is to identify potential security risks in a software system, based upon the design and architectural features of the system. This can be helpful to identify security risks, brainstorm defenses and mitigations, or pinpoint areas of the code that should be examined more closely for vulnerabilities. Attacks trees can be helpful to systematize the process of thinking through the space of possible attacks that someone might try against your system.
There is no way to automatically generate attack trees for a complex system. Attack trees do not eliminate the need for domain knowledge about the system and about computer security. You still have to understand the system, understand the kind of attacks you might face, and think through the potential risks.
The biggest limitation of attack trees is that they can be enormous. Building a complete attack tree is very labor-intensive, and it seems unlikely in most situations that this effort is the best possible use of an expert's time. This is probably why attack trees aren't very widely used. Most work on architectural risk analysis and threat modelling tries to provide ways to identify the highest-risk possible attacks. See, e.g., STRIDE and other techniques to try to focus in quickly on the most significant risk factors.
Anyway, I think you've understood the basic gist of it. What precisely is your question?