Correct. You just have to make sure you generate the
seed on a machine that has never been online and never will be.
Not never has been, only never will be again. The machine can be online 5 seconds before you generate the seed, so long as you ensure it will never connect to the internet again. seed on a machine that has never been online and never will be.
This includes network-capable printers if you're printing paper wallets, best bet is to physically remove the network card from the machine!
There is an attack vector where your machine could get corrupted while online and then use pre-determined random numbers
or a set of seeds known to an attacker. So at that point it doesn't matter if the machine is offline,
the attacker caused the victim to unwittingly use a known seed/private key which the attack is
monitoring.
Note that you could mitigate this attack by rolling dice or flipping coins which the
ultra-paranoid should be doing anyway.
