With ephemeral (EC)DHE or KEM key exchange, the server's private key only signs the handshake; an attacker who steals it later cannot decrypt recorded traffic. With TLS 1.2 static RSA key transport, the same theft decrypts every recorded session, which is why TLS 1.3 removed it.
Forward secrecy is only as good as the deletion of secrets: session ticket encryption keys, cached sessions and long-lived 0-RTT keys can undo it, so rotate ticket keys often. It does not protect against a quantum adversary who records traffic and later breaks the ephemeral key exchange itself; hybrid post-quantum key exchange addresses that.