How to validate that partially signed transactions aren't malicious?

Question

Taken from https://solanacookbook.com/references/offline-transactions.html#partial-sign-transaction

If Alice is the fee payer and has to sign the transaction, how does she know that Bob hasn't included an transfer instruction to take all of Alice's coins?

// 1. Add an instruction to send the token from Bob to Alice
transaction.add(
  createTransferCheckedInstruction(
    bobTokenAddress, // source
    tokenAddress, // mint
    aliceTokenAccount.address, // destination
    bobKeypair.publicKey, // owner of source account
    1 * 10 ** tokenMint.decimals, // amount to transfer
    tokenMint.decimals // decimals of token
  )
);

// 2. Bob partially signs the transaction
transaction.partialSign(bobKeypair);

// 3. Serialize the transaction without requiring all signatures
const serializedTransaction = transaction.serialize({
  requireAllSignatures: false,
});

// 4. Alice can deserialize the transaction
const recoveredTransaction = Transaction.from(
  Buffer.from(transactionBase64, "base64")
);

Answer 1

Wallets simulate the transactions and show the user all instructions that the tx has inside. Eg. the wallet will show all incoming and outgoing token movements before the user approves it.

Answer 2

If Alice is the fee payer and has to sign the transaction, how does she know that Bob hasn't included an transfer instruction to take all of Alice's coins?

Alice can also deserialize the transaction and can see the instructions