And how do Bob and Sally use their totally offline cold storage for.. uh.. anything other than paperweights?

Oh, right, they need to unfreeze the wallet using something like metamask and then execute a transfer, running against a service they can't audit... and hope there are no scams in that process, and that metamask isn't vulnerable, and that they only click the right authorization prompts..

Of course this assumes they aren't transferring from a known terrorist or a company ignoring KYC laws which might also land them in hot water.