In the most simplistic terms, yeah. That's true. But the constraints aren't really shaped like that. For instance:

A completely-innocent Airtag speaks only bluetooth, and it can be activated from continents away -- as long as any Apple phone is nearby with a shred of Internet access.

My similarly-innocent Samsung phone is programmable (using its built-in Routines function) to perform actions in response to becoming disconnected from any given Bluetooth device.