Trouble understanding hierarchical deterministic wallets

"HD wallets also offer the option of creating public keys without having to access the corresponding private keys. This means they can be used on insecure servers or in a receive-only mode."

Could anyone explain how this works?

Also, if someone had a private key from an HD wallet, could they derive all of its child keys?

I'd love to hear someone talking about it in their own words. Also taking suggestions of what to read up on. Seems like most explanations I come across are similar and pretty superficial (and many seem derived from the same explanation found in "Mastering Ethereum")