Ah, you are right. The transaction data is just required to display what is to be signed in a human-readable format. This lets the user decide whether it wants

Ah, you are right. The transaction data is just required to display what is to be signed in a human-readable format. This lets the user decide whether it wants to proceed with the signature or not. Otherwise, some malware could intercept transaction signature requests and replace them with arbitrary data (e.g. a transaction that empties the user's wallet). That's also why manually typing a hash in an air-gapped computer/device isn't going to work, you need the full transaction data.