There are several posts explaining different approaches to generating an offline wallet. The consensus seems to be that a cold paper wallet is the most secure, but can someone explain why?
It is most secure because in the process of generating a cold wallet, the device used to create it is never exposed to a network.
This means that the only piece of information required to spend your funds didn't ever have a chance to be stolen by some hacker! Recall that the only way you 'own' monero is having the correct private spend key (or the 25 word mnemonic). If you completely isolate this piece of information and keep it 'cold' on a piece of paper, the only risk is someone breaking into your house and finding the piece of paper (or a bad random number generator - that's why you need verified software to generate it, too).
Either way to generate it is OK (downloaded copy of https://moneroaddress.org, CLI wallet, or GUI wallet).