I plan to put the usb key locked inside a box under by bed. And i will uninstall and delete the bitcoin core client on my desktop.
Then in a few years when i need the bitcoins, i will install bitcoin core client and upload the money.dat file, and i should be back in business?
Say the computer was online (you had to be to download Bitcoin Core) so it got a virus. You make it offline but the virus is still there. When you make the wallet, it records your password and copies the file. Then when you go back online it sends it to an attacker and he just stole your Bitcoin.
It doesn't matter whether Bitcoin Core is presently installed or not, as long as the attacker has the wallet file and your password, the money is gone. To be fully secure, you need to create the wallet and any cold storage wallet for that matter on an offline computer that has never been online in the past. This includes virtual machines since a virtual machine running on a compromised host is just as bad as using Bitcoin on a compromised computer.
Yes you have to do it with a computer that never or never again will touch the internet. So a disposable VM or a linux booted is indeed ideal.
If at any point during or after the wallet creation the computer is connected to the internet, the priv key is never guaranteed to be cold storage.