Yes, you're missing that grabbing an airgapped PC with a fresh debian install is less fool-proof than you are proposing. The victims here thought they were buying an airgapped device but due to a supply-chain attack they were not actually airgapped. Of course the odds of their being a secret modem in a random PC you buy to be your own homebrew ledger device are nearly 0 -- but it's certainly not impossible or even difficult for a motivated attacker -- it's just unlikely because there would usually not be enough value in snooping on a device like that. What you are talking about is just security through obscurity, not actual security.