The hardware wallet a.k.a cold storage, is predominantly protecting you from key exposure.
The thought process is if your private key is on an internet connected device there’s always a possibility that it can get compromised.
A hardware wallet will generate a private key for you offline and you can sign transactions in an air gapped fashion. e.g.
You might have a ‘watch only’ wallet on your phone that only has the public keys. When you want to move your funds the watch only wallet will create a transaction that is not signed. It will then display the transaction as a QR code that your hardware wallet can read.
From there the hardware wallet gets the transaction and is able to sign it. Then your ‘watch only’ wallet can read the signed transaction via an QR code from the hardware wallet; all without ever exposing the private keys to an internet connected device.
