It's a hell of a lot easier to hide something that an attacker is unaware of, than a laptop, a phone or a hardware wallet. A physical attack can only happen if you A. Know what you're looking for or B. Happen to stumble across something over smarter of hours or days tearing someone's house apart. It's also free rather than $100 and you don't need to worry about all of the other countless vulnerabilities that constantly pop up with hardware wallets.

I agree that a 37 character password suggestion is not going to be taken up by the vast majority of users, meaning hardware wallets just aren't as secure as truly offline generated private keys (not that they ever were).