If you don't update and uninstall ledger live (which is where you get your updates from) to minimize the risk of an update that doesn't ask for your permission, the remaining risk would be a ledger signing key leak (Which happens: https://arstechnica.com/gadgets/2022/12/samsungs-android-app-signing-key-has-leaked-is-being-used-to-sign-malware/) resulting in an attacker including malicious firmware in a virus which may be multipurpose.

So in short, just airgap it, but if you're going to go through the effort to airgap it, you're already at the stage of using an airgapped PC.

Maybe Liana wallet can help you better think about backup options and things: https://wizardsardine.com/liana/

And Glacier protocol can give you the run down on all security considerations you might have: https://glacierprotocol.org/