I get that what we're looking at a browser extension that relies on a bunch of webshit, some of which was malware.

As somebody not versed in "web3" specific webshits, I thought the point of a hardware token is that there was some kind of verification on the device itself. So this doesn't seem sufficient to "drain" a wallet - right?

My assumption would be that the computer running the malware never gets the key material directly, rather it submits some request to the hardware token, which prompts the user with the details on some external physical display. The user reviews the details, then does something in meatspace that causes the hardware token to sign the something in question and pass it back to the software on the PC.

So isn't it the case that the user would have to approve the malware drain transaction themselves? And if not... what's the point of these devices, anyway?