So these "lite" wallets connect to a remote node and, query the transaction data from them through a rpc interface and scan through it on their side. They trust the remote node to speak the truth when scanning to not feed it fake transaction data. So in the worst case you might calculate a faked balance and transaction history.