You're right in your understanding: 1. and 2. hold true. What makes a wallet "cold" is the way it was generated. The wallet file + password, which you describe, could be made cold as well.
If you boot-up from a LiveCD (entire operating system, usually linux, bootable from a CD and containing all the tools necessary) with networking disabled, create a new wallet, save the seed and save the encrypted .keys file to some USB, and then reboot, there should be no record of your wallet or the process used to create it left anywhere except on the piece of paper and/or the wallet file on the USB drive. By doing this, you just created what we call a cold wallet. The only way it could be compromised is at the moment of creation, if the random number generator on the LiveCD was compromised to generate a predictable sequence of wallets. For extra paranoid mode, you'd roll the physical dice yourself to get the random seed.
The moment you open your wallet on an online PC, or restore from keys on an online PC, you can't consider it "cold" anymore, because there's always that slight risk that you leaked something. In fact, I'd say that opening the wallet file would be more safe than restoring from keys, because of what you pointed out already - if someone gets your password, he will need the .keys file as well, while the mnemonic would be enough by itself.
lets say my password is a huge strong password I keep in a safe spot,
Why is that 'not enough' ? ( I see lots of posts encouraging cold
If you generate the wallet like above, you just created cold storage, so it is "enough". It's all about managing risk, really. Think of cold storage as savings account, online wallet as your debit card with access to your current account, and web-wallets as cash in your pocket.