Bought one yesterday, waiting for it to arrive. 

I've read through the FAQ and the manuals on the website but there are still some parts that I don't really understand...

Does the Trezor hold your coins? or are they on the Trezor web wallet (or whatever wallet you're using)?
Isn't it still possible for hackers to create malware and upload it onto a trezor through the "update" function?
 

I'm sorry if these questions have already been answered in this thread but as you can see, the thread is almost as long as a book.