Anyone with access to your homeserver can change your password and log into your account. That's why by default, when someone logs into account, their session is unverified and doesn't have access to encryption keys. To verify it and sync encryption keys, you have to mark it as trusted from another device you own (which sends the encryption keys from the old device), or if it's the first session it becomes the only trusted device (and generates new encryption keys).

Note that the homeserver owner can always reset all of your sessions and encryption keys, then log in as the first session. They won't be able to read your past encrypted messages obviously, but they will be able to impersonate you. To prevent that, you can additionally perform the same verification process for the devices of those you chat with - that way they will also know which devices you marked as trusted.