every subdomain has it’s own directory on the server when it’s created, so for example, if in the cPanel I set the
mysite.example.comas a subdomain, the relative directory will be created in the root of the server, with the name ofmysite.example.com. I’ve read that the subdomains must point to the main wordpress installation directory.
You seem to be answering your own question. Yes, the subdomains all need to point to the main WordPress installation. This is how multisite works, all requests are handled by the same WordPress installation, by the same front-controller (mod_rewrite directives in the root .htaccess file).
When creating a subdomain in cPanel you should have full control over the subdomains “document root”. (It even allows you to point it to a directory that is entirely outside of the main domains document root if you wanted to.)
By creating a subdomain that points to a subdirectory, you are setting the DocumentRoot of that subdomain to that subdirectory. It won’t necessarily be able to access files in the directory above (the main domains document root).
When you access the subdomain, which probably does not have an index document (and directory listings are disabled) then you will get a 403 Forbidden response by default.