The "to" and "from" arguments are public wallet addresses correct? What's stopping anyone from passing in any two public wallets and stealing tokens. Im assuming the private key is used, but where and how? Is the private key passed in somewhere else? Is it passed in along with the public address? Help is greatly appreciated!
You have to be approved to spend tokens from another persons wallet. Aka they have to send an approve call to the contract to approve your address to spend on their behalf. Hence,
Checks to make sure you are the from address, or the from address has approved you.