How exactly do token approvals work? As they cost gas fees, I assume they must be stored on the blockchain.

Let's say, I approve uniswap to spend all my eth. Does that mean that a central entity has access to all ethereum on my address without needing (essentially bypassing) my private key to sign any transactions? Will the blockchain just check for approval in this case, rather than checking whether or not the transaction has been signed with the correct private key? Or is it merely an authorization for any web3 application to prepare a transaction, but it would still need my confirmation?

If no additional confirmation is needed to spend my eth at any time, would that mean that anyone who hacks uniswap for example, would have access to all approved tokens on any wallet that approved them to uniswap?

If I were to approve spending all my eth to a scam website, would only the address that I used to confirm the approval be compromised, or would all addresses associated with my private key be compromised?

If this scamming website would try to steal my coins, would they need me to confirm a transaction for every steal attempt they perform? Or would I at least have to be logged into my wallet (Metamask in my case) for any stealing attempt to be successful?

And what if I use a hardware wallet like trezor. If I approved spending of all my coins to a scamming website and they would attempt to steal it, would they need me to manually confirm something on my wallet? Would they be able to steal even at times when my hardware wallet is not connected?

And lastly, can I manually change the maximum amount of tokens that I approve to be spent (in Metamask for example)? Because often, it is unlimited.