(Not sure if you can see this without logging in to the server.)
Is this actually a problem? He turned off WiFi on the phone, but the lock was already / still connected to his WiFi.
It actually makes sense that IoT devices would aggressively try to join available networks via every method possible. Most people - especially those buying IoT devices - aren't networking experts, so "I can't connect" would probably be #1 through #7 highest volume of customer service issues if it didn't magically Just Work.
My guess is the button press on the lock was a WPS connection to the WiFi.