What can a hardware wallet protect against, and what can’t it protect against?
My understanding: malware could alter what’s shown on your computer screen, so the hardware wallet’s own screen is the last checkpoint. You should verify the recipient address on the device screen.
Some hardware wallets use dedicated security chips to protect private keys and make physical attacks more difficult.
The $BTC I plan to hold long-term are often kept in a hardware wallet, and transactions are signed on the device.

Don’t take this as advice.