I see the risk in this and I think it also applies to other NIP07 applications that can get signatures on notes from the extensions (they could publish fake notes signed by you).

There seems to be no other way than to show the user what they are signing. I wish nostr:npub1getal6ykt05fsz5nqu4uld09nfj3y3qxmv8crys4aeut53unfvlqr80nfm had a dedicated way of showing details of the ecash that is being signed. Maybe one day?

Definitely needs trust in the application that is requesting these signatures. What's true for signing messages is also true for signing transactions.