I'm wondering..

Does Trezor provides also protection from malicious client code (modified source code of electrum or any other bitcoin client)? So, technically, as I see it, there is no way for someone to hack into github and modify electrum source code and steal someone's bitcoins as long as you have 'watching-only' wallet and you have to sign every transaction with Trezor (and be able to check a destination address on the screen of the device). Is that correct?

This would add a whole new level of security as you don't even have to trust source code of a client.