Q:

Necessity of physical access to air-gapped computers

In an intriguing paper Fansmitter: Acoustic Data Exfiltration from 
(Speakerless) Air-Gapped Computers (also see this summary) the authors demonstrate that they are able to exfiltrate data from an air-gapped computer by modulating the rotation speed of the cooling fan. A similar thing has been done using a computer's internal microphone. Obviously this type of attack requires physical access at some point to install the malware.
What I don't fully understand is this: why go to all this trouble if you need physical access to your target anyway, and could then just extract whatever data you're interested in? What am I missing?

A:

What I think is important to point out about malware targetting air-gapped systems is that as much as these methods require physical access, it doesn't require that the attacker himself has physical access. 
The idea is to spread the malware on as many computers as possible around the targeted system so that someone who is allowed to physically access it will eventually plug a contaminated USB key to the said system. 
However, these methods seem to still require the attacker to be fairly close to the target to pick up the sounds produced. I think it is usually more efficient when the objective is to cause damage to the air-gapped system (erasing data, causing disfunction in automated industrial tools etc...).

A:

One of possible answers is in the condition you noticed yourself: "this type of attack requires physical access at some point to install the malware". It doesn't require physical access at a later point in time.
An attacker might have had the physical access before the data was created or stored on a target machine and exfiltrate the data later.

