What gruez said is correct. Hardware token have been mandated for EV certificates for a long time by providers to prevent leaks.

I'll also add that Amazon Key Management Service, Azure Key Vault, and Google Key Management Service store several hundred million private keys combined with no leaks so far (they are non-exportable and access is audited)

It is very rare that we see malware signed by a publisher's certificate, which is why it is in the news every time it happens.

Hardware tokens are mandated for EV code signing certificates[1], but not for regular certificates. However, the certificate was from a while ago so that requirement probably wasn't a thing back then.

[1] https://www.digicert.com/signing/code-signing-certificates "REQUIRES TWO-FACTOR AUTHENTICATION USING HARDWARE TOKEN"

I bought a Windows EV code signing cert just months ago. It comes in the form of a password protected USB token.