This statement is false because even if end-of-life systems are not connected to the internet, they can still pose a significant security risk. Vulnerabilities in such systems can be exploited through physical access, malicious insiders, or infected removable media. Additionally, lack of vendor support means that even newly discovered vulnerabilities will not be patched, leaving the systems perpetually vulnerable.