The CA key should be well protected against physical attacks, because you do not want it to get stolen. It is an extremely valuable asset, since the corresponding public key has been embedded in widespread operating systems. So it must lie in a tamper resistant device (a Hardware Security Module), and that module should be in a bunker with guards.
On the other hand, it makes little sense to have a protected bunker if the employees just enter and exit it all day long. For a commercial CA which issues hundreds or more of certificates every day, the employees who handle the identity verification procedure and decide that the certificate should be issued must be, in practice, located "elsewhere". So now the device with the signature key is linked to the employees through some sort of network.
Physically private networks are extremely expensive, so everybody just uses "the Internet" and some sort of cryptographic protection for that link (e.g. SSL). So there you have it: the CA is "on the Internet" because it would be impractical (i.e. very expensive) to do otherwise.
Also, a CA should periodically publish Certificate Revocation Lists, that it signs with its private key. This also requires a regular network connection. You could do it with a daily/weekly manual transfer with a USB key, but human employees are not cheap, contrary to a crontab and an ethernet cable.
Good CA use a two-tier system with an offline root, which is used only once per year (this time by entering the bunker) to issue sub-CA certificates to the machines which actually do the common certificate signing.