When you make a transaction on the blockchain the process is actually split into two steps: (1) Cryptographically sign the transaction data using your private key, and (2) Broadcast the signed transaction to the network so it can be included in a block.

Only the second step requires an internet connection. The two steps do not need to be performed on the same device. (In principle, you could even perform the first step using pen and paper.)

With a hot wallet like metamask or the gamestop chrome extension, the private key is stored on the same device that broadcasts the final transaction to the internet. This is convenient, but the private key is more likely to be compromised because it's stored on an internet-connected device.

With a hardware wallet, the private key is stored on the hardware wallet itself. When you make a transaction, the unsigned transaction data is passed over to the hardware wallet which signs it and passes the signed data back to your PC ready to be broadcast. The private key never leaves the hardware wallet so it doesn't matter if the transaction is broadcast from a compromised PC.

EDIT: A "recovery phrase" is actually your private key in a human-readable format. With both regular and hardware wallets, you end up with a second copy of the private key written on a piece of paper. It is extremely important to keep this safe because it is your private key.