A hardware wallet keeps the private key inside a chip that never reveals it. Transactions come in, signatures go out, and the key itself cannot be exported — malware on your computer can ask it to sign, but can never copy it.
Key theft. No phishing page, infostealer or clipboard hijacker can copy a key that never exists outside the chip.
You. The device signs whatever you approve on its screen. Approve a drainer's transaction and the hardware executes the theft flawlessly. And a seed phrase typed into a phishing site bypasses the chip entirely.
Blind signing
Approving a transaction the device cannot fully display. You are trusting the website's description of what you are signing — which is the exact trust a drainer exploits.

The chip guards the key. Nothing guards your judgment. That part ships with you.
Where this goes next
The chip guards the key, not the decision. What you are approving, and how a drainer dresses it up, come next.