I think that the encryption part take place inside hardware wallet.
That would be my guess. And my next guess is the decryption keys are only known to Ledger and/or their "storage partners". That makes me wonder who has a backup, and how they were created. One way or another, it adds a risk that shouldn't exist in hardware wallets.
And that brings us back to this gem:
Oh, but it gets better. Ledger changed their story, admitting it was a
former employee who got phished:
How many former Ledger employees still have access to their codebase? Ledger won't say, not that we could trust any answer they'd give.