Malware can implant destination addresses, and steal private keys in hot wallets.

The hardware device can operate in a malware infected environment, and not be compromised.

Private key = safe