Well "impossible" is impossible to prove which is why in the linked answer I said "almost impossible", maybe even that is overstating it. By using a secure hardware device the attack vector goes from "malware installed remotely on host steals secret," to "attacker needs to physically gain access to the hardware device and destructively remove the private key." The latter is certainly not impossible, but it is a lot more difficult.
Those usb dongles work very similar to smartcards. I have more experience with smartcards so I will use that in the answer but most of the same principles apply. In fact many of those usb dongles use a smart card SoC internally. They are cheap, programmable, and offer robust security so in many applications it makes sense to just use a smartcard internally rather than try to build something new.
A programmable smartcard is a complete computer in a single chip, or system on a chip (SoC). Now it is a very limited computer but still a computer. The connection to the "outside world" for the smartcard is a low privilege simple serial interface. The card gets a command (more like a request) from the host and the card responds with a response. The commands are limited to what the card has been programmed to do.
So if we have a smart card programmed to digitally sign an instruction (like a payment request in credit card EMV), the host will send a request over the serial interface to the card consisting of a command and some inputs. The card parsed the command and assuming it is valid it sends back a digital signature to the host over the same interface. In many ways it resembles a client-server relationship with the smartcard being the server and the host system being the client. The private key never leaves the card during the process. It is just request in, response out. The host has no mechanism to force the smartcard to return the private key or do anything it wasn't programmed to do. Of course this assumes there is no "please give me all the private keys" command which would obviously be pointless and provide no security. The smartcard may have a user assigned PIN and the PIN is part of the command format. The smartcard verifies the PIN and if it is invalid will reject the command. It has its own internal memory so it may record internally the number of invalid attempts and be programmed to shutdown (or in extreme cases erase the card).
The programming (flashing) of a smartcard is done prior to shipping. Of course if an attacker could just reprogram the smartcard to run a "give me all your keys" program it wouldn't be secure so most cards employ some sort of security bit in write once memory. So the card is programmed and the write bit set. The card will then reject any future attempts to reprogram.
Try not to get hung up on a smartcard doing exactly this. They are programmable devices so they will vary in implementation but the general concept is you have this self contained computer with its own internal secure storage which has been programmed to respond to requests from a host over a simple low permission interface. I do agree the word "impossible" is marketing but it isn't that far from the truth. You could say practically impossible. The very basic design and locked functionality means you end up with a hardened device that is difficult to attack.
However the old axiom "there is no information security without physical security" still applies. The private key is still physically in the smartcard. With physical access and enough motivation you can do pretty much "unsecret" any secret. As in the linked example the smartcard can be bypassed and the key read out directly off the physical memory. A common method is to take the card, remove the SoC and use acid deconstruction to burn away package. Using an electron microscope and enough skill you could locate the spot on the silicon which stores the keys, connect leads and read them out. It has been done so it definitely is not impossible but in most cases that isn't the type of attack or attacker we are trying to defend against. Honestly if your attacker would go to that level I would be more worried about a $5 wrench.