I don't think that Hardware Wallet is secured since it can be hack by a spyware or worms and it depends if the antivirus is updated or can detect it since some of the new wares or virus are updated now.
Erm, track down whoever told you that and twist their nipples until they pass out.
You can plug your hardware wallet into the most disgustingly virus ridden machine and you'll be absolutely fine. That's the whole point of them. Nothing on the internet can access the private keys.
There are plenty of attempts to trick you into entering its seed into websites but you'd have to be exceptionally dim to fall for it.
Bottomline, still on you how you will be a target of those phishing attacks. You should not be gullible in entering your private keys to just anything that will pop up. He might have entered his keys unknowingly to some site he didn't know was a phishing site. But such amount is really heavy on pocket. I guess, he learned his lessons well by that traumatic experience.