The host computer prepares transactions (PSBTs, Ethereum RLP or EIP-712 data) and the device verifies what it can: outputs and change paths for Bitcoin, recipients and amounts for simple transfers, decoded fields where it has metadata. It signs with keys derived from the BIP-39 seed, which never leaves the device, and should display full addresses for comparison.
Its security boundary ends where the screen stops being informative: blind-signed hashes, unknown contract calls and permit messages defeat it. Good practice is verifying receive addresses on the device, keeping firmware current from the vendor's channel, protecting the seed backup more carefully than the device and using multisig across vendors for large holdings.