The risk is in your software client by trezor being compromised. And you approving a tx to a malicious address.

Depends what software you use, but you should be fine as long as you verify the address you are sending to on the device. You should always be doing this anyways.