> But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet.

Pretty sure this is not the case for Trezor (This was an angle that got addressed a long time ago). Also, Ethereum doesn't have a change address.

> So far I’ve been putting it off because a single wallet and being diligent about checking the output address that you send to seemed sufficient.

If you are too concerned and use Bitcoin, there is an easier/simpler way. Sign the transaction offline and don't broadcast it. Copy the transaction Hex and decode it. You can there read the details of the output addresses, fees, etc.. When you are sure, then you can broadcast the transaction.