It's just a private key. You don't "connect" private keys to the Internet. You just have poor processes keeping it hidden while not losing it. I'm surprised you think El Salvador can do that.
In order for transactions to be signed with the private key, the device holding them has to be connected to the internet, or at least be able to interface with another device that is. It is highly likely that anything involving their BTC reserves requires someone to be physically present at some sort of facility and it is 100% not available for hackers to just siphon whenever they wish with a virus. If possible, it would at least require physical infiltration.
