Cold storage and air-gapped signing are treated as the same idea, but they answer different questions. One concerns where the key sits, the other concerns how instructions reach it.
Storage is about exposure of the key material
A key is cold if it has never been present on a device connected to the internet. Generation matters as much as storage, since a key created on a compromised machine was never cold.
Warm setups keep keys on a device that connects occasionally. Hot setups keep them on a machine that is permanently online, which is what exchanges and automated systems require.
The distinction is about history rather than the present moment. A key that spent an hour on a networked computer years ago is warm for the rest of its life, because there is no way to prove it was not copied.
Signing is a separate question
A key that never leaves a device still has to authorise transactions, and every signing method opens a channel between that device and the outside world.
A hardware wallet plugged into a computer signs over that cable. An air-gapped device receives an unsigned transaction by camera or removable card and returns a signature the same way.
Neither approach exposes the key. What differs is how much software sits between the transaction being built and the signature coming back.
The transport channel is the interesting attack surface
Data crossing a cable travels through drivers and a communication protocol, which is more code than a scanned image or a file on a card.
An air gap narrows that channel to something a person can inspect, which is why it appears in high-value custody arrangements rather than daily-use wallets.
The trade is convenience. Scanning codes in both directions for every transaction is slow enough that people avoid doing it often, which is acceptable for a reserve and impractical for spending money.
The screen decides whether the gap helps
Isolation only helps if the signing device can show you what it is about to sign in terms you can check: destination, amount, and network.
Where the device cannot decode the payload and displays a hash instead, you are trusting the computer that built the transaction, and the isolation has bought less than it appears.
Matching the arrangement to how funds are used
A key that signs weekly and a key that signs once a year should not sit behind the same setup, because the friction that protects the second would be ignored on the first.
Splitting balances by frequency of use is the practical answer. A small connected balance absorbs routine activity while the larger reserve stays behind whatever process is slowest to operate.