how would the hacker steal the funds ?
Using some kind of malware. You seem to be cautious enough not to be fooled by malware replacing addresses. Keep in mind that if your wallet file containing the private keys is stolen while you go online, the attacker could broadcast a transaction with a higher fee and there is a chance that it will be accepted by the miners earlier. Those are really extreme cases. I have never been affected by those.
This setup you are suggesting is actually and over-complicated Hardware wallet, after all. Where you store your private keys offline and use them to sign a transaction prepared on an online PC.
'overcomplicated' is an exaggeration. It is a good setup if one does not trust hardware wallets. OP didn't mention them so I also skipped