There's a concept of hot and cold in security. Hot things are well connected and exposed. Cold things are isolated and hidden.

When you have a Bitcoin wallet on your phone, it's considered hot because an attacker has many avenues to get the private key off your device: it's connected to the Internet, you're carrying it around and using it in public, you may leave it lying around when others are around, etc.

When you have a hardware Bitcoin signer, that is considered cold because an attacker has very limited ways of getting the private key off of it. A hardware signer, like the coldcard, creates the key on the device itself and can be used without ever connecting to the internet. The signer can also be kept in your home or in a safe when not in use, so you can make it very difficult to steal it.

These are both instances of "self-custody" but there is a spectrum of choices you can make to secure your key or keys.