Apple devices create an encrypted mesh network. So every Apple device nearby potentially can pass encrypted messages from either a "Find my iPhone" or "Find my AirTag" BT beacon. Eventually it finds a device that is connected to the internet and the packets are forwarded to the Apple Account bound to the Air Tag.

I think the encryption and tie to an Apple account prevent arbitrary people from doing that.