You can not just rely on air gapped either. You have other avenues for attack as well. I actually virtualize most of my legacy OSes when possible. Just maintaining adequate serial connections when a USB to serial connector will not work with your legacy OS and a VM can't maintain a stable serial connection through the host OS. It's been a nightmare.