'air gaps cannot be hacked'

An air-gapped system is not connected to anything, which removes ordinary remote attack paths and does not make it unreachable.

Data still crosses on removable media. Engineers still bring laptops. Updates still arrive somehow, and the supply chain still delivers equipment. Several of the best-documented attacks on isolated industrial systems crossed exactly these routes. The isolation is genuinely strong and the belief that it is absolute is what stops anybody watching the remaining paths.