Thanks for checking this so thoroughly — your interpretation is absolutely correct.
The Heatmap feature in Matomo doesn’t set cookies or collect any additional personal data on its own. It works by visualizing aggregated interaction data (clicks, scrolls, mouse movements, etc.) that have already been captured through the standard Matomo tracking setup.
A cookie is only created when Session Recordings are enabled, since those recordings require session identifiers to replay individual user interactions.
So yes — if you’re only using Heatmaps (without Session Recordings), then there’s no need to request additional consent beyond what you already have for your standard analytics tracking. The behavior you’re seeing is intentional and compliant with Matomo’s privacy-by-design principles.