While it is technically correct that you can encrypt content for a recipient key that is contained in an S/MIME certificate without having a certificate of your own, this is not the same thing as sending an S/MIME email.
While the RFC allows for
Enveloped only S/MIMES it does state:
It is important to note that sending enveloped
but not signed messages does not provide for data integrity. It is
possible to replace ciphertext in such a way that the processed
message will still be valid, but the meaning can be altered.
In production mail clients, S/MIME messages are hence always signed - whether or not they are encrypted. While you do not need a key pair and certificate for the encryption part of S/MIME, you do need one for signing that encrypted message.
In my opinion both parties needs S/MIME certificates in order to communicate securely. Is that correct?
Yes, and for good reason: S/MIME is not only about confidentiality but also about authenticity; when an E-Mail is not signed properly, authenticity is out of the window.