Sjunet is not air-gapped though. Clients can connect via vpn over the internet.

It's not necessarily air-gapped. There are many ways to accidentally or deliberately patch the intranet and internet together.