Airgaps are certainly intended to protect against every skill level hacker. The ideal strategy is the multi-layered, Swiss cheese approach. A slice for RBAC (LDAP, AD, MFA, etc.); a slice for email phishing filters and user awareness training; another for network segmentation and isolation (Firewalls, proxies); another for network filters (ping DDOS attacks, etc.); and on and on. The APT attack strategy uses every tool in the arsenal and hunts for a path through the cheese layers, hopefully never finding one to the real prize behind.