It depends on the device.
If you are using the android or iPhone app, then the answer is no. Only the files you want to read are downloaded for decryption
If you use a desctop app, then it depends also.
If you are using Cyberduck as 3rd party app for direct accessing you vault, then the files are downloaded and decrypted on demand.
If you are not using a 3rd party app and store your decrypted files in Cryptomator WebDAV network drive, then you’ll have to use the sync client of your Storage provider to sync the encrypted files to the online storage. In that case obviously all the encrypted files are always on your device as well.