Ledger: is the private key tied to the device or the wallet?
The keys are tied to the mnemonic (or seed phrase or recovery phrase) that you use. The keys are derived directly from it. If any gains access to the mnemonic, they can directly produce the private keys that you used without access to any of the physical hardware. Furthermore, having the mnemonic does not allow them to unlock your hardware wallet - the PIN you use is independent of and unrelated to the mnemonic and the private keys. But that is moot because if someone has the mnemonic, they don't need your hardware to take your Bitcoin.
Importing means that you setup a new device with the same mnemonic. So anyone with the mnemonic can still take your Bitcoin. If they get access to the old device and figure out the PIN, then they can also take your Bitcoin because it is the same private keys.