how would the hacker steal the funds ?
Using some kind of malware. You seem to be cautious enough not to be fooled by malware replacing addresses. Keep in mind that if your wallet file is stolen while you go online, the attacker could broadcast a transaction with a higher fee so that there would be a chance that it would be accepted by the miners earlier. Those are really extreme cases. I have never been affected by those.
This setup you are suggesting is actually and over-complicated Hardware wallet, after all. Where you store your private keys offline and use them to sign a transaction prepared on an online PC.
'overcomplicated' is an exaggeration. It is a good setup if one does not trust hardware wallets. OP didn't mention them so I assumed that he doesn't want to use them.
Yes, it was a little bit of overstatement. Better not to derail the thread too much discussing pro and cons of the different solutions. I just wanted to make things clear (maybe only to me).