True, but it doesn't have to be online for it to happen. Someone (like maintenance) could plug in a rogue USB thumb drive or something that is otherwise infected - see the famous Stuxnet virus, which infiltrated an airgapped (not network connected) Iranian nuclear facility.