Doesn't Ledger require confirmation of each transaction by physically pressing a button on it?
I haven't really used it too much, but I guess that's the biggest advantage of hardware wallets because physical access to the device is also required. What is missing here?
Yup. To withdraw from Ledger, there are four confirmations; launch the crypto app (e.g. BNB), the amount to withdraw, destination address and associated fees.
Likely he was under the impression that the same applies when claiming those free tokens/ NFTs.