Why should a root CA be offline most of the time?

Its private key is the anchor of all trust in the PKI; if it leaks, every certificate ever issued under it is worthless, and the only fix is to rebuild the PKI.

Whoever holds the root's private key can issue a certificate for any name (any web server, any user, any code signer) and every client accepts it, because they trust the root unconditionally. A compromised issuing CA is bad but recoverable: the root revokes the issuing CA's certificate, a new issuing CA is set up, and the clients' trust store stays unchanged. A compromised root cannot be revoked by anyone above it. The root certificate has to be removed from every client and a new one distributed, and every certificate in the hierarchy reissued.

Keeping the root offline (powered off, not joined to the domain, often a standalone machine with the key in a hardware security module, in a safe) removes the network attack surface almost entirely. That works because the root is rarely needed: to sign a new issuing CA certificate (every few years) and to publish a fresh CRL for the issuing CAs (perhaps every few months, done by switching it on briefly).

Concerns to weigh: an offline root must still publish CRLs before the old one expires, or clients start rejecting the whole chain; and the key needs a secure backup, because losing it is as final as leaking it.

Go deeper:

• Microsoft: Designing and Implementing a PKI, Part I — why the root is offline and the CRL-publishing chores this creates.
• Wikipedia: Hardware security module — where high-value CA keys are kept so they cannot be copied.