You are sort of right, at least in all my rental experiences in the US.
Generally in the US when you rent an apartment through VRBO or AirBnB the owner (or agency) will send you a code with which you open a lockbox attached to the door, where the key is located, or sometimes the door has a code pad rather than a key, and you enter the house using that code.
In Italy that was the case also in many cases (in other cases they would meet you in person and give you the key/passcode at that point). Basically the owner would send you the instructions via email after you sent them a copy of your passport, and presumably the payment (I doubt they'll let you in before they received the money). Italian law requires a landlord or hotel owner or apartment host to report the identity and a copy of the passport/ID of all guests to the police headquarters within 24 hours from check in (this is done remotely via secure internet portal). Usually you would send a copy of your passports via email, and they would upload everything onto the Italian police portal.
However, a couple of months ago, the Italian government issued a Ministerial Circular in which they stated that the owner of the apartment (or its agent) must ALWAYS meet the renter IN PERSON, and verify the passport (or ID card) in person or "de visu" (face to face, in Latin). In other words the Italian government said that it is not sufficient for your to send your passport copy via email to the owner so that the owner can report the rental to the authorities, but they have to verify your identity in person.
So, assuming the apartment/home owner follows such recent directive, you should be met in all cases by a real person first, who will check your passports in person (I'm sure they will have asked you to send a copy via email previously as well). They might give you the key or passcode at that point (or maybe they might have sent the code to you previously) but they are now required to see you in person and check your passport in person. Whether they will actually do it or continue to do the things remotely as before remains to be seen.