Suppose you have a device which (for historical reasons) has the private user-signing and self-signing keys, but not the private master key.
In that case, the "cross signing" tab in settings will look like this:

"Private Keys on device" is incorrect. The listed keys are the public keys.