Missing output confirmation in Bitcoin replacement transactions

When signing a replacement (RBF) transaction, the device skipped the standard recipient-confirmation screen for outputs that were not present in the original transaction. A malicious host could therefore include an additional external recipient in the replacement without that address being displayed for approval; the user would only see the resulting amount and fee changes. Replacement transactions can no longer add new recipients at all — the device rejects them outright.