Law One of Computer Crackers: If I can touch your device, I own your device.
Law Two of Computer Crackers: If you device does not have a password, I definitely own your device.
Okay, so those are not really laws, at least not written ones. I am just stating them to make a point.
Because you have no device security to access it, anyone who gets hold of your phone can do anything they want.
What if the thief is smart enough to turnoff the Android Device Manager first before doing stuff with the mobile?
Does Android require Google account password first before disabling the Device Manager?
Then you are out of luck. You do not need a password to disable/uninstall any application through settings.
Will the Remote Erase work once the device goes online ? (Do they use device Id or IMEI for this)
No, it uses your linked Google account to erase the data.
No sim Card. Location Turned off. No Data/WiFi.
But before any of this, you say there is no sim card (meaning no carrier service available) and no wifi. That alone means that you are not able to do anything with device manager. If the thief were to connect it to the wifi, then you could, unless they have removed your account before connecting to the wifi.