Many hobbyists assume, "I’ll just install the ISO on an air-gapped machine (no internet) and I’ll be fine." But isolation is not a perfect shield. Here is what actually happens:

: A library for "abandonware" and legacy software that often hosts older Windows versions for archival purposes. Microsoft Evaluation Center

Plugging a USB drive that has been used on any modern Windows 10/11 or Linux machine into a vulnerable Windows 7 ISO can trigger an like CVE-2015-0096 (Stuxnet-style .LNK vulnerability). The USB doesn't need to be malicious—it might simply carry a file with a poisoned shortcut.