If you can get the malware on the machine and physical access, do you even need this sophisticated attack?
It's hard for me to imagine a scenario where all this is practical
In the Stuxnet attack, famously [0], the malware propagated via craftily-formed autorun.inf on USB sticks that ferried data into the facility. Nothing crossed the otherwise-robust air gap in the other direction, but nothing had to in that case.
Lessons have been learned since then, but this sort of possibility (electromagnetic exfiltration vector) has, for quite a long time, been taken seriously enough to inform secure facilities’ physical design [1].
[0] https://www.eweek.com/security/stuxnet-worm-nine-facts-every...
[1] e.g. https://www.nsa.gov/portals/75/documents/news-features/decla... , https://www.ncsc.gov.uk/information/tempest-and-electromagne...