They always had internet access. Of course it is possible that they decided to rip out the internet connection in the new models together with the touch screen, but I heavily doubt that they want to trust the internet connection of a random stranger to do whatever important communication they have to do with their servers. The app only requires internet access because... well, it always needs internet access.

I'm currently developing firmware that supports both Bluetooth and cellular connection for a hardware device. With proper cryptography, you don't have to trust the random stranger (e.g. using TLS). In fact, you can get away with no connection at all. For example, when someone locks the locker, it sets a "password" via Bluetooth and when you open it, your phone simply transmits the "password" via Bluetooth.

I'm not just thinking of trust in terms of whether the device will tamper with the data, but also stuff like: What happens if you just put the parcel in the locker and in that exact moment the internet connection cuts out? Normally the parcel locker would send some data to DHL servers (as made evident by the fact that the lockers can send a confirmation mail), how do you get that information out now? Of course you could queue it up until the next person arrives, but all of that seems... suboptimal to me.

Cellular modems and data plans can be expensive and unreliable. If you can do without, at the cost of very rarely being out of sync (like in your scenario), it can be considered an interesting tradeoff. Plus, even if they were equipped with cellular modems, they probably have a business requirement that the locker should be usable even when the cellular connection goes offline, so you have to design your protocol to be Bluetooth-first.