the output:
contains a lot of blank lines. That makes it appear that you are using the Serial Monitor to send data, and that the Serial Monitor is configured to add carriage return and line feed to the string being sent.
Printing the data as I showed would confirm exactly what is in readString.
So, what you should be doing is looking for the String to contain "on" or "off", rather than for the String to BE "on" or "off".