I don't get how the hack is carried out just from clicking a dodgy link, why does that mean the hacker suddenly has access to their hardware wallet? It's not like they now have the pin or key phrases?

Someone explain please..