Typically the sheep dip station has AV and some other antimalware tools, but depending on what you're trying to do you might have a dedicated sheep dip person that manually checks the content of what you're importing/exporting (particularly for sensitive IP in large engineering and research organisations). When this happens, it usually takes weeks to get anything approved for import/export.
Then again, I suppose in that case you could have malware that detects what system it's on and decides not to activate on the dip station :)
> unconnected system
I understood this to be a literal description.
I presume that this sheep dip station is maintained and updated, from time to time. However, that would be done using controlled, vetted media. And, if something goes wrong there, it has to been in the nature of something that will cause the masking of problems existing on the written/finalized media that the sheep dip station is in turn vetting. (Unless it's something that can "un-finalize" the vetting media and further write to it.)
Or is the sheep dip station periodically connected while it is itself maintained/updated? That I could see presenting problems.
In any event, I read this to mean in particular that the sheep dip station is not networked with the air gapped system.