> Why aren't they running agents on isolated computers without Internet access?

They probably will soon, but even air-gapping may not be enough. See stuxnet for instance