An intranet could be a secure environment walled off from the internet

Hard disagree. How can it be “walled off” from the internet if it’s not connected? Despite the jokes, cutting access on its own is not the same as air gapping or a firewall. As soon as it’s plugged in there are zero controls.

Technically they could claim it’s a backup