Is offline Bitcoin transaction signing safe? How can offline transaction signing ever be safe? I'm relativly new to bitcoin and this is one part that I cannot understand. 

Lets say I create a transaction at my watching-only wallet. Then I sign it on my offline wallet. That means I just "toggle something"/"add some data that says signed" when I'm signing my transaction at the offline wallet. 

Isn't that easily hackable so that everybody can easily sign transactions without knowing the private-key? I mean the watching only wallet has no clue of the private key so there must be some information that is != private-key in the data that comes back from the offline wallet.

Even if I sign it at the online-wallet somebody could just change the sourcecode of the client that he does not need the private-key to sign something.
Lets say I create a transaction at my watching-only wallet. Then I sign it on my offline wallet. That means I just "toggle something"/"add some data that says signed" when I'm signing my transaction at the offline wallet.


That is not how Bitcoin or digital signatures work. By your logic wallets (online or offline) wouldn't work in general. Private keys are not broadcast to the network or given to anyone unless the person who generated them (and thus owns them) does something.

Digital signatures work via mathematics to generate a proof. With a specific message and public key, only the person who controls the private key that corresponds to the public key is able to generate a valid proof. That proof is the signature, and that is what is added to a transaction. Signatures do not require the signing device to be online. Signing is an entirely offline operation that only does math, nothing else.


  Even if I sign it at the online-wallet somebody could just change the sourcecode of the client that he does not need the private-key to sign something.


The signature validation operation is a consensus rule. Every must follow that exact rule otherwise you will be forked off of the network. Sure you can make a client that doesn't do that validation, but then you aren't using Bitcoin, and if no one uses your client and its forked blockchain (as that will happen), then your transaction and coins on that chain are completely worthless.