Are you speculating or speaking from experience? Either way, I'd like to imagine in these scenarios that the really, really secure stuff is kept offline or somehow on a non-Internet connected network.
I am speaking from experience on non-NSA programs.
It goes without saying that their entire operational network is firewalled with an air-gap. If a user needs to have internet (or other extranet) access from the same desk as their operational network, they will have an entirely separate terminal for it, they may even have rules that require a minimum distance between the two terminals.
