In the most simplistic terms, yeah. That's true. But the constraints aren't really shaped like that. For instance:
A completely-innocent Airtag speaks only bluetooth, and it can be activated from continents away -- as long as any Apple phone is nearby with a shred of Internet access.
My similarly-innocent Samsung phone is programmable (using its built-in Routines function) to perform actions in response to becoming disconnected from any given Bluetooth device.
