The satellite is never a middleman, it’s an address book, bookkeeping, audit and repair service, that’s all.
All downloads are handled by storagenodes directly. The only exception are inline segments, they are stored directly on the satellite (it acts as a storagenode in that case).
Do you mean the Gateway-MT service? Even in that case data is downloaded from storagenodes, then combined to the files and decrypted, then delivered to the customer via encrypted channel. The Gateway-MT is a distributed service too (as a satellite), but the barebone is a distributed network of nodes.
They never uploads via satellites. If they uses a native Storj integration, their uplink requests 110 independent nodes from the satellite for each segment of the file (64MiB or less) and then start uploads in parallel, when the optimal number of uploads are finished, all remained got canceled.
If they would use an S3 Storj integration, then they would upload files unencrypted via a secure SSL protocol to the Gateway-MT (if they uses S3 Compatible Gateway Hosted by Storj - Storj Docs) or to their own Gateway-ST (Setting Up a Self-Hosted S3 Compatible Gateway - Storj Docs), where files are encrypted with your provided encryption key, sliced to pieces and uploaded to the nodes via a Storj native protocol as described above.