Use case for air gapping technics, despite their small bandwidth:

- very powerful agencies with the aim to get valuable information exists

- they want and do infect as many systems as possible automatically, by sneaking into them by all means avaiable (OS updates, hardware backdoors, zero days, ..), wih the hope of getting to valuable targets eventually (but zombies have a value, too)

- any organization with very sensitive data, high value research or other (smaller) intelligence agency knows that, so they try to have their most sensitive data on air gapped networks or single computers.

- the attackers already drown in information and do not want their virus to be exposed so easy, so air gapping technics will likely be not used normaly to reduce dedection risk (also the are slow and unreliable)

But, now to get the most sensitive informations, all the atackers have to do, is checking if the system is air-gapped. Means, it is likely that it is a high value target.

Now the various technices come into play, so the virus tries to communicate with the outside world in the hope of a also infected device nearby with which it can maybe exchange a few kb.

If he can make a small connection, then a human (or algorithm) can check, if it is really a high value target worth deploying more sophisticated attacks, or just a paranoid hacker trying to protect his personal stuff, or just a old forgotting pc.

In other words, if you have really sensitive data, air gapping it, might be the way to attract attackers in the first place ..

Computer security is hard.