Documentation on encryption context in contradiction with the behaviour?

The AWS documentation on encryption context ( https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context ) states that:

"When an encryption context is provided in an encryption request, it is cryptographically bound to the ciphertext such that the same encryption context is required to decrypt (or decrypt and re-encrypt) the data. If the encryption context provided in the decryption request is not an exact, case-sensitive match, the decrypt request fails."

In our case we have an SQS queue with encryption enabled and a lambda function triggered by messages arriving to the queue. In CloudTrail events for GenerateDataKey the encryption context contains the key "aws:sqs:arn" as expected:

"encryptionContext": {
    "aws:sqs:arn": "arn:aws:sqs:eu-west-1:accountnr:queuename"
},

However, Decrypt events in CloudTrail contain a very different encryption context:

"encryptionContext": {
    "aws:lambda:FunctionArn": "arn:aws:lambda:eu-west-1:accountnr:function:functionname"
}

So, the contexts do not contain the same key in both cases, even though you would expect so, based on the above quoted sentence from AWS documentation. Also you would expect decrypting to have failed due to differing context but it seems to work just fine.

Presumably I cannot use the same KMS key policy condition for readers and writers in this case to verify that "aws:sqs:arn" contains a specific value since the Decrypt context does not contain such key (?).

Did I misunderstand the documentation sentence or why does it seem to work differently?