Hardware examples are Trezor and Legder, to use them you have to connect the device to the internet to be able to use them but your keys are safe from the internet, the connection can be established with a USB type c cable and Bluetooth where as;
Hardware wallets which are connected via USB or Bluetooth usually don't have firmware code in them with which they could talk to the internet and vice-versa directly (or even indirectly), even when the connecting computer or mobile device is online.
Compagnion software wallets like Trezor Suite, Ledger Wallet, BitBox App and other software wallets only can talk to your hardware wallet if those are supported. The software wallet part uses defined APIs which normally won't allow private keys to leak to the online device. An infamous exception is the Ledger crap with its paid Recovery Service where supported Ledger hardware has firmware code to exfiltrate encrypted private key shards upon request via the Ledger Wallet software.
Needless to say, I won't ever use Ledger shit-crap. You do yours...
As a decent hardware wallet (not counting Ledger to this) simply can't talk to the internet and vice-versa and leak private keys, I personally consider them cold devices, even when they connect via USB to an online host device. You don't have to agree with my viewpoint.
Paper wallet is also a cold storage where your keys are generated and printed on a pieces of paper, it's only when you import the wallet online it no longer a cold storage.
I would consider a paper wallet only "cold" when it was created on a "cold" and offline device and this device with its OS never connected to the internet after the paper wallet creation. Therefore it's recommended to use live Linux that runs solely in RAM and has no persistant storage and can be disposed completely without data traces after paper wallet creation.