There is always risk but it’s small. It is not truly airgapped if you have to connect it to your laptop. Coldcard lets you do the update without plugging it into your computer. But you still have to use a microsd card to get the update file or transaction signatures from your computer to the device. I believe you could also use the passport to scan QR codes and never plug it into your computer. But for updates on the passport I think you may have to use Bluetooth.

These are all very complicated and sophisticated attacks that are theoretically possible to do but difficult and expensive to pull off.