Yup, clearly, a connected device will never reach paper wallet security
until you want to spend it
(that should be a new meme ...)
Create a transaction offline, sign offline, broadcast
Over
But in real life, I have used your solution to sweep a private key
Even with offline transactions though, you have to move a USB stick between offline and online computers, creating a possible vulnerability, correct?
Correct. A malware can change the firmware of the stick in such way that it do nasty things when connected to another computer. For more detailed technical explanation please see https://srlabs.de/badusb/