Think of it like old school checks. The mint/bank can rug you, the person that wrote the check can try a kiting scam. So trust is involved. If you're not online to withdraw the funds to your mint or lightning wallet a bad actor can leave you holding the cashu token.

This is just my experience testing it with two self hosted implementations and running various scenarios.  So now you have two ways to create offline bitcoin "checks"
1. A PSBT that you send to the merchant that they broadcast onchain.
Or
2. A cashu token they redeem via cashu/lightning.