What is the basic idea of security-by-isolation, and why is complete isolation only a theory?

"My system cannot be reached, so it is secure": security by isolating the system from interaction. Complete isolation is theoretical because every cyber system has a task and needs a minimum of interaction.

* In theory every path is cut; in reality the operator and the controlled plant still interact with the system. *

It is the oldest security concept. The first computers had no cyber security of their own. They stood in suitably secured rooms, the threats assumed an attacker had to be physically present, and there was no networking and no remote access.

In reality you get extensive rather than complete isolation, because some interaction is always needed. Examples of minimal interaction:

• a person operating a console directly at the system,
• the control of an industrial plant connected to the cyber system.

Go deeper:

• Air gap (networking) — Wikipedia — where physically isolated systems are still used, and how data gets in and out anyway.