Sometimes humans bridge the gap to carry stuff in (firmware updates, say; or data for analysis, or reference material), and the hope is that no medium allows data to flow the other way. So depending on the sloppiness of the enterprise, you might be able to get stuff in but not out.

In the Stuxnet attack, famously [0], the malware propagated via craftily-formed autorun.inf on USB sticks that ferried data into the facility. Nothing crossed the otherwise-robust air gap in the other direction, but nothing had to in that case.

Lessons have been learned since then, but this sort of possibility (electromagnetic exfiltration vector) has, for quite a long time, been taken seriously enough to inform secure facilities’ physical design [1].

[0] https://www.eweek.com/security/stuxnet-worm-nine-facts-every...

[1] e.g. https://www.nsa.gov/portals/75/documents/news-features/decla... , https://www.ncsc.gov.uk/information/tempest-and-electromagne...