The indexes also know about packages the machine does not have. apt-cache policy shows side by side what is installed and what can be installed. Both commands on the card only read, so they need no sudo.
What is installed and what can be
Compare what apt-cache policy knows about tree and about cowsay. Install nothing and do not run apt update.
First, predict
The machine has no network, and nobody installed cowsay. What will apt-cache policy cowsay print?
Now start the exercise, run the command and compare your prediction with the output.
The Installed line holds the version from the package database; (none) means the package is not installed. Candidate holds the candidate: the version apt install would pick from this machine's indexes. Indexes get out of date, so the candidate is the newest version the machine knows about. In the version table, the 100 /var/lib/dpkg/status line is the package database itself, and *** marks the installed version.