cold just means "offline". It's not the absolute most secure for every possible attack vector, but it's better than running Rando Wallet on the 10 year-old computer your mom downloads .exe email attachments on.

The keys are stored on the USB drive, which can be encrypted, and which can be hidden (the same way we store seed phrases).