How do i know a pop up on my screen is a genuine update? and who says its not a hacker pretending to provide a genuine update 2.7.0 say it was a hacker could they take my coins from me entering the password ?
The seed words never leave the device, so a hacker would not be able to steal your coins with just your password.
I would assume malware if the update were to ask for the seed words as well. AFAIK the only situation where Trezor Suite would ask for the seed words would be during wallet recovery. However even during that process you have the option to enter the seed words using your hardware wallet, bypassing any potential malware on your computer.