This particular attack has nothing to do with air-gapped networks, but you're right in that usb drives are used this way. In fact, they are the one and only communication method ever used to jump air-gaps in real attacks (at least that have been publicly reported). Plenty of other theoretical methods have been demonstrated though Dropping this exhaustive analysis here in case anyone's interested in this topic: https://www.welivesecurity.com...

The trick is that the spreader component infects newly inserted USB drives and creates shortcuts (.lnk) files with the same filename & icon of the legitimate files. End users don't end up opening "unknown files", they think they are opening files that they expected to be on the drive.

You should realize that people who systematically manually verify the hash of the files they download represent an infinitesimal proportion of all internet users.

It may not be in your threat model, but it is to some Internet users. Have a look at this report for example: https://www.welivesecurity.com... The fact that other threat vectors are more likely to impact users does not mean that rarer cases should be ignored - they are not mutually exclusive.