BIP39 seed words are used to deterministically generate all of your private keys in your wallet. You don't have to store the private keys themselves. Remember that each address has its own private/public key pair, and addresses shouldn't be reused. BIP39 has been the standard for many years.

Hardware wallet is assumed to generate BIP39 seed words securely. If you don't trust the RNG, some hardware wallets also support adding your own entropy with dice rolls. [0]

[0] https://coldcardwallet.com/docs/verifying-dice-roll-math