Yep. As long as your LAN is functional and the hub (which uses the ZigBee protocol often referenced in the comments here) is appropriately routeable, internet access is entirely optional - unless of course you want to control the lights from outside of your home.

Then what prevents the app from being the path, in either/both directions? Reporting on the activities of the devices it can see, as well as sending firmware updates to them?

Your printer gets firmware updates from HP, whenever HP wants, right past all your firewalls and vlans and non-routable subnets, in the form of print jobs from your pc.

Source? While in principle your reasoning make sense, is this actually how HP updates their firmware?

Where did it say the app has to be on a device that can see the internet?

If you want to control your lights from outside your home you can either setup a WireGuard LAN or just enable the integration with apple home if you are already in the ecosystem.

Apple has less incentives to spy on you than whoever is running philips hue.