This wouldn't be the first time an air gapped wallet was swept. Darky Skippy attack wasn't that long ago and it impacted wallets with unverified firmware on devices that don't have means to verfiy upon booting up.