> It only matters if the machine is online, and they often aren't.

No.

Really, you shouldn't think that. It's really bad security practice.

https://en.wikipedia.org/wiki/Stuxnet

It is typically introduced to the target environment via an infected USB flash drive, thus crossing any air gap.