They can't. With a hardware wallet, your private keys do not leave the hardware wallet. Any transactions you make are generated on your computer, sent to your hardware wallet to be signed by the private key(s), and then the signed version returned to your computer to be broadcast. The whole point of a hardware wallet is that you can use it safely on any computer, even one infected with malware, without risk of losing your coins (provided you double check the addresses and amounts you have entered are correct).