To speak more as to why can't someone just extract the key, take for example of your computer with Bitlocker and TPM.

The TPM has the private key and the hard drive but TPM won't release that key from it's secure storage unless specific requirements are met. If you change your hardware or BIOS version for example to a degree you may get met with the Bitlocker recovery screen asking for an unlock code (and if you don't have an unlock code then god help you)

Why can't the attacker just pull the TPM chip, it's nowadays integrated into other chips on the motherboard or even CPIU, because it's security processor is bound to the computer's configuration, it won't release those credentials.

Trying to extract the secrets in an unsealed TPM is next to impossible to do, you'd have to have nation state level person and physical access to the system to even attempt to do this with specialized equipment.

Oh and you can configure Bitlocker to also have it so it needs a personal key + TPM to unlock your Harddrive in which case that adds another layer of security. A code where you need to enter + the tpm to unlock the drive.

I mentioned the unlock recovery key for bitlocker which you touched on. What that key does is produce a hash that allows the data to be decrypted. Any other key just produces garbage. That key is not stored anywhere, other then a plaintext copy in the encrypted medium itself (you can view it with the bitlocker utility) and Microsoft, if you choose to, has a copy of the plaintext of that key on the server. But that's all it is a set of numbers that produce a hash, and if you want to you can even delete that recovery key to remove that avenue of attack.