What the air gap does and does not do

What crosses, and in which direction

Nothing carrying a private key crosses in either direction. The seed is written down by you, on paper, once. A backup file can hold an encrypted copy if you ask for one, and it says so in those words before it writes anything.

What it stops, and what it does not

The air gap stops one thing: a remote attacker reaching your keys over a network. It is very good at that, because there is no network.

It does not stop:

A malicious transaction. Everything arriving is chosen by whoever built it. A PSBT can name any output, any amount, any fee. The gap does not review it and neither does the transport. That is what the signing screen is for, and it is why this device shows you the whole transaction and makes you look at it.

A malicious address on the other screen. If the machine that built the transaction is compromised, the address it shows you and the address in the transaction are both chosen by the attacker. What defeats this is checking the address on the device, which re-derives it from your seed rather than comparing two things an attacker controls.

A compromised device. If the code on the Pi is not the code you think it is, nothing about the transport matters. See Verification.

Someone watching the screen. A QR code is a picture. A camera pointed at the device sees everything the device shows, which includes your extended public key and therefore every address you will ever use. It does not include your seed.

Someone with physical access. See Out of scope below, which is specific about this and about how little any of it helps against a determined adversary who has the device and has you.

---