Sure it does need the cloud - you might have notice that the kill command was delivered _over cloud connection_. And author carefully blocked not entire connectivity, but only the part that they considered "logs". They wanted to keep cloud control, just not the whole thing.

Given the complete lack of relevant technical details, it could be something as simple as "internal log storage full, refusing to start up until logs uploaded". We'd never know.