Even if they have internet access, they’ll still need your iCloud account details. So yes, they’ve basically got a fancy paperweight.

Even if lost mode is still pending, the phone is activation locked to your iCloud account. If they wipe it and try to setup the phone again, it will require them to enter the account details to complete the setup.