The only security risk is the USB stick, but it's easy to configure to never actually run anything off it and it's OK.
A better option, rather than relying on any sort of live media to transfer transactions back and forth, is to use QR codes. Generate a transaction, turn it in to a QR code, scan it on the airgapped device, sign the transaction, turn it back in to a QR code, scan it on to the live device, and broadcast. That way you complete remove the risk of accidentally transferring malware to your airgapped device.