Please, never mind this, I do not get your point here. The encrypted passphrase should be BIP38 right? Which is also even called password, correct me if wrong. But, the hierarchical deterministic wallet only follow the BIP39 passphrase standard which is generated through salting in which making seed phrase to generate another keys and addresses entirely, this are the passphrase which make use of extra words, and it is what is supported by Trezor. BIP38 is used for wallets like paper wallet, not hierarchical deterministic wallets.
It doesn't have to. BIP38 is just another way to conveniently encrypt things but they do have a version byte identifier. Advantage of BIP38 is that the identifier allows you to see that it is a BIP38 encrypted key and probably an encrypted private key. The encryption used for BIP38 can be used anywhere and it is.
You will need to operate your wallet in a safe environment, making your computer to be completely safe from malware.
Not needed. If you have to do so, then there is probably no point for a hardware wallet.