Most of the time the system is compromised before being in an air gapped setup, for instance in the supply chain.