Fair on the half that matters most: with no radio and no network, a compromised management engine has nowhere to send the seed. The Ledger objection was never that the chip could read the key. It was that firmware could be shipped to forward it, and that path ran through the connected channel. A real air gap closes it.

What stays open is the part a QR code does not cover: the machine decides what you read before you sign. A closed stack below the operating system can show you one address while the signature pays another, and the seed never has to leave for that. Nor is the loop one-directional: anything the machine can encode it can put into a QR it asks you to scan with the phone that is online. Slow, carried by hand, but not closed.

Immunity was never on offer; the size of the trusted part is. One device with one job keeps it small enough to read and rebuild.