In the case of hardware wallets, the 24-word recovery seed will be the master password. The public and private keys are derived from this recovery seed using m/44'/135'/0'/0/address_index derivation path, the same way of how EOS public keys get generated but with a different coin type in the derivation path, which is outlined here. I have tried generating a Steem public key from the private key generated from an EOS keypair generation tool, and the only difference in the generated public keys are the first 3 letters, where Steem public keys start with STM, whereas EOS public keys start with EOS.

The address_index that completes the path to derive the public key (that is bound to Steem accounts) will be stored in desktop wallets. The WIF private key will be generated using the same derivation path every time there is a signing request, hence there is nothing to write to the flash memory which has limited cycles (500,000 writes according to Ledger's documentation)

You may find the source code here