Now, there could always be a iCloud fallback that says if there is internet, just use it. Perks of using non-free software is that it will almost always non-verifiable.
How is this possible? Bluetooth? USB? Or are we talking about a previously synced draft that's still there when you turn your internet off? Sounds like a basic iCloud cache to me.
1. Attach an attack device to someone’s account.
2. ‘Poll’ the clipboard by pasting every ~5 seconds.
3. If the contents of the clipboard appear to be ‘secure’ (looks like shellcode, bitcoin address, url, etc), quickly replace the contents with an attack string with same datatype.
If you have an untrusted device attached to your Apple account, your local clipboard can no longer be trusted.
You could imagine a copy/paste that waits for a message from the cloud (because Apple push notifications are pretty solid), then opens the new connection to the local device, so the data never leaves your network. At least to me, that sounds needless complex when the typical use case could just send the entire payload with the "go look for this device" message.
I don't use a Mac or an iPhone, but I applaud this sort of device harmony.
That said, I am worried that it would unnecessarily leverage the cloud. My guess is that instead of the two devices directly communicating with one another—that is, instead of leveraging the fact that they are probably on the same local network and should just work in concert—the clipboard data will be sent via a cloud intermediary. That is, it will be exfiltrated from the local network, sent through Apple, and then back into the local network.
If I am wrong about that, I am happy to hear it.