The security of the system is entirely because this key material cannot be extracted. I don't know how Samsungs trust zone implementation works, but the Apple

The security of the system is entirely because this key material cannot be extracted. I don't know how Samsungs trust zone implementation works, but the Apple secure elements (Ax,Mx,and T2 coprocessor) burn fuses randomly inside the SoC on first power up. Those fuses are used to further encrypt everything down the line from that. There are APIs on macOS+iOS to create asymmetric keys where the private key is handled by the secure element and cannot ever be extracted. Encryption (or signing) using those keys is performed by the coprocessor. This is the model you want from any "hardware wallet" you might have, and is the model you want to actually secure your data.