Oh, there are plenty of ways to attack offline systems. Side channel attacks, supply chain attacks, etc.

Most of my job as a security engineer is making offline systems you can actually trust.