Yes, exactly.
In the case of XOM and I assume the other large blenders, they are able to run all of the API and ACEA sequences in-house. Both the API approval and the ACEA sequences lay out a series of parameters/requirements for the lubricant that it must, at minimum, meet. So there are limits on all of the sequences and the oil must at worst, meet the limits imposed. Of course it can exceed the requirements (perform better than the limit allows).
These are of course organizational requirements/approvals, not OEM.
Now, some of the OEM testing, like Ford's, is just a stricter set of limits based on the API sequences, and so you'll see the Ford approvals fall under the same category. I am unsure whether they are able to self-certify for the Ford approvals or not.
When we get down to approvals with actual license numbers and sequences run by the OEM's themselves (like Porsche A40 for example, BMW LL-01...etc) Mobil puts these under the Approvals category, as they are not running these in-house and they cannot self-certify, the product needs to be approved by the OEM.
On the fox guarding the hen house remark, while Mobil is able to run all of the sequences for API/ACEA in house, many of the smaller blenders will just buy pre-approved additive packages from Infineum, Lubrizol...etc and blend it with one of the approved base oil combos to generate an approved product. So this product may not be formally tested, or not tested the way Mobil/Shell/BP would test it, at all depending on the scale of the operation in question and their resources. Since Mobil/Shell own Infineum and also produce a lot of the base stocks, it does really come down to whether you trust these orgs to QC their own products and if you do, then there's no reason to doubt their self-certification for API/ACEA either.