You say that but I am actively dealing with a chinese malware(public info) I won't name that does just that but with USB. It sideloads a dll when a shortcut opens a legit app on a USB (shortcut is tricky in that it looke like a folder and opens a folder also when you click on it) it then collecte all kinds of documents and exfils to the internet but if there is no internet it archives it back to the USB so next time it runs with internet access it will also exfil any docs on the USB from the airgapped machines, fortunately just a spillover infection for us but these tricks in the paper would enable to not wait for a USB or internet access, it would be more realtime. Like if it is an ICS system for nuclear centrifuges it will send back what ir found and accept destructive tasks.