Yes but there is a choice - the Trezor finds the addresses on demand and send to server via the web-page, or the webpage, knowing the XPUB, sends the addresses to the server, or the server gets the XPUB. Three possibilities. I looked over the bitcointrezor.com site in hope of finding the answer, but I didn't. So you are probably right, the XPUB is sent from the Trezor all the way to the server.
It's not #1, the Trezor doesn't know which outputs it owns, or which addresses are used.
Pretty sure it's #3, it makes the most sense. Otherwise the JS client would either have to send the server a large number of addresses at once, or check them a few at a time. Looking at the
source code here, it seems to support this.