How can Trezor update firmware but never receive malware? I understood from What is it about a Trezor that means it can't be infected by malware? that a Trezor would only interpret data as transaction details, but the Trezor also updates firmware.  How is it that an attacker can't hack the firmware update to somehow install malware?
You actually can't update all the firmware. In particular, the portion of the firmware that implements the security logic cannot be modified, it's burned in for good.

If you want to take full control over a Trezor, which would even let you load malware onto it, you can. However, the internal security logic would still wipe all the data in the unit when you did and display a warning each time the unit was started. So you can't use the firmware update path to steal secrets, nor can you trick someone into using a modified Trezor, so long as they watch the startup.

Assuming all this is implemented correctly and has no bugs or defects, that leaves only the possibility of malicious firmware signed by the manufacturer so that it would be accepted by the security firmware without tripping the safeguards. So to some extent, you have to trust the manufacturer. However, if they ever signed "evil firmware", and that firmware got out, their reputation would be ruined.