zzz Well, that is a very good question!
As I know, an offline, but out of date operation system is still can be vulnerable. Consider the following: even if it is not touching the internet, but if you transferring data from it back and fourth, an outdated OS is definitely way more vulnerable for all kind of threats what you might accidentally transfer there on your usb stick. And infected file, malicious app, shady pdf or compromised usb is still a threat, and an outdated system is more vulnerable for such things. However, we are talking about a sandboxed application here, maybe even in a separate profile. My guess is that it still could be a potential exploit surface, but it is probably not too likely scenario indeed. But I'm only guessing, in anyone has more thoughts on this, I would be curious too!