I believe you are correct in your example. The sender needs to talk to the mint to create some ecash locked to the recipient's pubkey. It includes a locktime clause so the sender can sweep the tokens back after a timeout. You can do fully offline sending and receiving if you're running a cashu mint on your phone. If not, the sender will need to have a network connection or mint tokens ahead of time.
Discussion
It's always possible for the mint to do shenanigans. User and mint is a trusted relationship. In the offline market I think you could have multiple offline cashu mints that compete in terms of reputation. It's free banking in the digital age. 🤙
Don't forget to sweep those tokens once you are back on WiFi!