Your understanding is mostly correct. Using Bitlocker in TPM-only mode (not the same as just "without PIN" because you could use another form of authentication, such as an external key on a USB device) means the disk encryption key will only be available if the OS boots up normally; if the boot process is modified by malicious code, or if the normal OS isn't booting at all (because you're booting to Linux or something instead) then the TPM won't reveal the key.
Bitlocker, in any mode, doesn't really "transform the normal Windows User login into something secure", except in the sense that you can't easily attempt offline cracking of the (weak) password hash the way you normally can. In fact, in TPM-only mode, it is vital that you have a strong Windows password on all login-enabled accounts, because the attacker can still attempt online brute-forcing of that password (though Windows will limit how fast they can try). However, it does mean that simply getting the hard disk without the rest of the machine will be useless to an attacker, and that getting the entire machine but with no idea what the login passwords are and no special attack hardware will be nearly as bad. On the other hand, even without Bitlocker, an attacker could encrypt data that is protected with a key derived from their login password (using DPAPI and/or EFS) and therefore require the attacker to get their login password (although in that case brute-forcing the NTLM hash is probably the easiest option, and with BitLocker you can't do that).
Note that there are limitations of TPM-only Bitlocker. For one thing, it's much easier to bypass using a hardware attack, such as freezing the RAM (once the encryption key is retrieved from the TPM) and physically removing it from the running system, then using external hardware to read the key out. TPM-only mode is also incompatible with any kind of intentional modification of the boot process, so any time the user (or OS) wants to install a patch that modifies the bootloader or similar, it must briefly "disable" Bitlocker by writing a clear-text key to the disk. This key is removed after successful reboot, but it provides a window where an attacker could bypass Bitlocker entirely. Finally, "TPM-only" Bitlocker still usually has a "recovery key" that the user is told to store somewhere; if the attacker gets that then they can bypass Bitlocker regardless of the other protections used.