It doesn't have to be internet accessible, AFAIK. If an attacker can get something to do arbitrary DNS lookups, I think it can be attacked. For instance, monitoring/log correlation software might be vulnerable.
[1]https://www.owasp.org/index.php/XML_External_Entity_%28XXE%2...