Important Be sure to save your raw transaction data in a safe place, because anybody with access to it will be able to spend your coins.
Whoa whoa, why is this written in trezor's official wiki?The RAW transaction doesn't contain his private key, it can't be recovered from the signature or redeem script.
It's also impossible to change the output without changing the signature unless they sign it with SIGHASH flag like SIGHASH_NONE
The only issue there is his privacy if he decided to share it.
Maybe the article meant: "spend it without your consent"?