Yes, you are correct that miners get to decide whether to include transactions in their block that they're mining. The protocol itself doesn't force them to include any transactions. Instead, they have a financial incentive to include transactions because they can collect transaction fees and profit more.
It's an interesting trade-off for them, because their profit has to outweigh their costs of validating those transactions. However, I suspect transaction validation doesn't cost miners anything because they can validate and hash transactions for block i+1 as they are mining for block i with different hardware: validation is done on CPUs, mining is done on ASICs.
But there are interesting cases: For instance, miner A has to recompute their next block i+1 if another miner B finds block i and it includes transactions from miner A's next i+1 block. In that case miner A would have to remove some TXs from his block i+1 and recompute the Merkle tree. Or miner A can create an empty block i+1 and just mine on that.
Sometimes, when mining on block i+1, miners even skip on validating other miners' block i in the hopes of winning the race by starting earlier [1].
Hope this helps clarify things a little.
