I didn't use trezor and similar, but logically, if I send you even a photo, I can implement a virus in this file,
is it a photo, txt file or wallet, it can be sent together with virus, trojan, etc.
another person already mentioned seed generated in advance, only one person should know the seed,