"If the attack surface of USB is too large for you, may I suggest this tablet running a 5 year old unpatched version of Android OS." (skeptical eyebrow goes up)
(FWIW I use HW wallets and just sorta deal with the unknowable gaps in both the products and my understanding of them.)
If the tablet has zero wireless capability and can only be used to sign transactions created by the software wallet I would already be using anyway, then I'm ok with whatever risk comes from the software being out of date.