Your recovery phrase is a complete backup of every key your wallet can ever generate. Anyone who has it can move your funds, with no PIN or device required.
That’s why it should never be typed into a computer, photographed, stored in a cloud note app, or sent over email or messaging apps — any of those turn an offline backup into an online target. A hardware wallet generates and displays the phrase entirely on its own screen so it never has to touch an internet-connected device in the first place.
A metal backup plate protects the physical copy from fire and water damage, but the rule that matters most is simpler: keep it offline, always.