What they protect
Hardware wallets keep your private keys offline, so malware on your computer cannot extract them. They require physical confirmation for each transaction.
What they do not protect
They cannot save you from approving a malicious signature yourself. If you confirm a drainer transaction on the device, the hardware wallet faithfully signs it.
Using one safely
Always read what you are confirming on the device screen, not just the computer. Verify addresses and approvals on the trusted display. Combine the hardware wallet with a browser layer that flags dangerous requests before they reach the device.