The short answer is that you are correct about the "Limited Access" permissions being added automatically, but if you are using SharePoint 2016 or newer, or SharePoint 2013 with the April 2016 or newer update, those "Limited Access" permissions are hidden from the Permissions page, and only visible through specialty link on the notification bar, or by enumerating permissions via script.
Unlike other default permissions, SharePoint automatically assigns Limited Access when it’s needed. Let’s say an HR manager wants to give a user access to a document. The permissions that grant access to the user are added directly to the content, permission inheritance is consequently broken, and Limited Access then automatically gives permissions to the user at the site level.
The following is Microsoft’s most up-to-date description of Limited Access:
"… enables a user or group to browse to a site page or library to
access a specific content item when they do not have permissions to
open or edit any other items in the site or library. This level is
automatically assigned by SharePoint when you provide access to one
specific item. You cannot assign Limited Access permissions directly
to a user or group yourself. Instead, when you assign, edit, or open
permissions to the single item, SharePoint automatically assigns
Limited Access to other required locations, such as the site or
library in which the single item is located."
So, What’s Changed?
Limited Access users are no longer visible through the permissions page, but with the release of SharePoint’s April 2016 content update, users now have the ability to list the User and/or Group with Limited Access Permissions, and can do so via a link in the Notifications bar.