iPhone / iOS Find My function doesn’t require cellular data.

https://support.apple.com/en-in/104978#:~:text=If%20Find%20M...

Still lots of devices that have physical SIM cards and would be senseless if the device couldn’t be tracked if the SIM was removed.

I figured it worked more like an AirTag and pinged nearby devices.

That's my point. Apple and Google are using local BLE broadcasts that get uploaded to servers for locating devices. That means ICE can detect/count people in the vicinity by just monitoring the location network signals your devices will emit. For some devices, the location beacon feature will keep working even if you turn them "off".