The payment address selection are still performed on computer before being sent to hardware wallet DERP!
Yes, that's why there is a display on the hardware wallet, so you have a chance to discover the error before you sign the transaction.
Truecrypt and Bitcoin are different, but they both can be compromised with malware on computers they operate. The only way to protect the computer is - don't run any malicious or insecure code on it!
Absolutely correct. That's why the crucial step - signing a transaction - is run on a microprocessor that no malware can reprogram