Naming the general-purpose machine the safer option is where the argument turns around. A cheap laptop carries a layer you cannot read: the Intel management engine, or the AMD equivalent, runs below the operating system, and the SSD controller runs closed firmware of its own. Your seed sits on top of all of it, and an air gap removes none of that.

The practical half matters too. A machine with no internet still needs a way out, so a second, online computer ends up in the chain to broadcast from. That hop is the same one a signer performs, only the signer's signing code is the one piece there you can read and rebuild yourself.

SeedSigner is the closest thing to your plan that already exists: a small board, open firmware, a screen showing the address you are about to pay, no general-purpose system underneath. One device with one job, against a whole computer with a thousand of them.