trezor signs the transaction, and sends the signed tx back to your computer
you broadcast it.
using an airgapped computer means you are putting a lot of faith into the rng. Trezor allows you to select your own pin & passphrase on top of the 256bit private key.
saying that you wouldnt trust more than 10 btc into trezor, but believe that airgapping a computer solely for wallet generation of btc over 10 is laughable. I mean, do you seriously believe that an offline version of bitaddress.org is safer than trezor?