Main answer to your main question in title: The string of words, known as the crypto wallet "recovery phrase", or "mnemonic words" or "seed words" are simply a human-readable format of the underlying machine-readable entropy - which is a large random number - used to create the crypto vault.
answer to your second and third question: The exact steps from seed to wallet addresses include the use of a hash function (HMAC) and key stretching with PBKDF2 with default values for the passphrase field.
[Excerpt from BIP39 specification "To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes)." ]
The BIP39 specification includes a notation scheme that uses a wordlist with 2048 values (with various languages supported) as a lookup table.
The way this works is when creating a crypto vault a certain amount of underlying binary data is generated by the cryptographically-secure random number generator (CSPRNG) of the wallet software which gathers random bits from the user's device locally, such as 128 bits for a 12-word mnemonic recovery phrase.
Those 12 words are simply a representation of the 128 bits + a 4-bit checksum (totaling 132 bits, based on 12 groups of 11 bits, where each group represents an 11-bit number in the list of 2048 11-bit numbers where each number correspond to a unique word on the list). So the words are just an easy way to recreate that number, as the words can more easily be handled (i.e write, recite, notate, store and otherwise deal with compared to writing or reciting a 132-bit binary number).
- Another option for backup instead of the mnemonic (although not
suggested), as an alternative or complement is to back-up the initial
entropy, whether in binary or hex format, or whatever base format
suits you, so long as any leading zeroes are not lost.
For example, the following mnemonic below is based on the following entropy:
132 bits of initial entropy: 011001011001101110001010000000111011111110111011100000001100110111001101110000111100001110000011110101001011000011010101000001011100
Length of total bits: 132 bits divided into 12 groups of 11 bits
['01100101100', '11011100010', '10000000111', '01111111011', '10111000000', '01100110111', '00110111000', '01111000011', '10000011110', '10100101100', '00110101010', '00001011100']
Corresponding index values for each group (in base 10):
[812, 1762, 1031, 1019, 1472, 823, 440, 963, 1054, 1324, 426, 92]
Corresponding mnemonic based on BIP39 english wordlist:
grain sword liberty legal retreat group damage journey long pitch crystal argue
The following tool can be used for educational purposes with recovery phrases: https://iancoleman.io/bip39/ (note: I am a contributor to that tool on Github)
I think it is best to refer to the mnemonic words as the "keys" to the "crypto vault" (and not the private key to a wallet or wallet address, which is a different context where the private key is multiplied with a generator point to compute the public address, using elliptic curve cryptography). Again, a BIP39 crypto vault that uses BIP44 can contain multiple cryptocurrencies (accounts with different derivation paths) and where each cryptocurrency can contain up to 2 billion derived child address, from their extended public/private keys based on the HD wallet structure as per BIP32.
Regarding your question about security/usability: In terms of whether a 12-word mnemonic is secure, we can measure that its maximum theoretic security in bits is at most 128-bits (using Claude Shannon's equation for entropy where (2048^12 = 2^132)-4 bits = 2^128), given the size of the initial entropy, and as the last 4 bits are deterministic we subtract that from the total bits that the mnemonic represents (as it is hash-based, which is a means to slow-down someone from brute-force trying random 12-words).
- Otherwise, removing just one bit will reduce security by one half, as
(2**127)*2 == 2**128, whereas, 128 bits of security is only the
square root of a 24-word mnemonic which has 256 bits of security
since (2**128)*(2**128) == 2**256.
In terms of whether these are secure enough, depends on the capabilities of an attacker. With Grover's algorithm running on a Quantum computer a search that would usually take n-time could be sped up to the square-root of n-time, thus a 128-bits of security could be reduced to 64 bits using classical computer security assumptions, whereas a 256-bit key under such a quantum attack could be reduced to 128-bits of security on a classical computer. There is also potential threats from Shor's algorithm running on a fast-enough quantum computer, as well as the quantum version of the elliptic curve factorization (ECM) known as GEECM, which could be applicable to bitcoin crypto vaults as well as private keys.
Regarding your question about HD wallets:
It isn't feasible to backup every possible private key in an HD Wallet, as there could be 2 billion of them per each supported cryptocurrency, each derived from the extended public/private parent keys (xPub and xPrv). Therefore, the mnemonics words serve as a major convenience for custody and recovery of those private/public keys as they can be easily derived starting from the mnemonic words or the underlying entropy that the words represent. And then the extended public/private keys can be used to recreate all the child private/public keys.
