

Since we are talking about payment systems that interact with other banking systems, they will not be actually air gapped. By the nature and purpose of the systems in question, they must have access to the physical Internet (even if it is entirely abstracted away under layers of VPNs and encryption).
Assuming them compromised is prudent. Physical access is total access.
Yes. It was a Neonazi from Britz doing it. He primarily targeted foreign cars, vehicles of local left politicians (Die Linke and SPD candidates of Neukölln both had their cars burned). He also lit up a few expensive cars, but that might have been because he ran out of “legitimate” targets.