I'd add to that any software / hardware that is supported with wallets such as Electrum or Bitcoin Core / Bitcoin for Android. My hardware wallet equivalent is an airgapped machine, but then I think I know what I'm doing. (I could be mistaken and not actually know everything that's going on, but that would seem unlikely.)
I would include that in the list of ways to safely produce the private key. But as you say it requires a little "know what you are doing", and just being able to get TAILS up on an air-gapped machine might be just enough to fortify the naïve user's bias that they know what they are doing when they do not.
It ends up being complicated. How do we define "air gapped"? for example. Turning the WIFI off on a laptop running ANY persistent OS (INCLUDING Tails under certain circumstances) would not meet my personal requirements. People will print their seed words on printers that cache prints.
There are even simple pitfalls people can make that are obvious seeming to us, but not maybe all folks. For example going to all the trouble to produce the private key safely and then typing the seed words into a wallet on a HOT machine.
Or something simple like people do not use a BIP39 password(phrase). Or they use one that can be brute forced. Or one that is on a list already.
Bitcoin security is NOT for the lazy. For sure.
And then there are the nuances. What risks do you take by subjecting even your XPUBs to exposure? Sure people will not be able to spend, but now we are delving into the privacy issue.
Shit... my BSOCD (Bitcoin Security Obsessive Compulsive Disorder) is kicking in hard.