Your understanding is correct: 1. Yes. 2. Yes. 3. Yes.
Yoroi remembers your public key so that it can lookup and display transactions and balances without needing to connect the Trezor. Your private key always stays securely on Trezor, and Yoroi will communicate with it when you sign a transaction using the Trezor. It is important to read all of the information (addresses and amounts) that Trezor presents you before you confirm a transaction, and not just casually confirm the transaction without scrutinizing it.