Why can't a hacker edit the Ledger Chrome app to display the address the user thinks he's sending to while actually sending to a different address?
He can1, just like he can hack your personal machine and install a keylogger or any other malware. The question isn't can he, but how likely is he to be able to given the protections in place.
(1I'm not concerned with how he might do this. I'm going down the "nothing is bulletproof" line of reasoning. Perhaps he doesn't hack the "real" app, but phishes you into installing a corrupt version, etc., etc..)
Suppose the scenario: Ledger employee wants a nice retirement, puts
out a "software update" to the Chrome app to send all ETH to his
address while the software shows the addresses the user thinks they're
sending to; steals a bunch of ETH from many users at once before the
message spreads on social media warning people to stop using the app.
(Or suppose it's someone who hacked their software repository
unbeknownst to Ledger.)
Yep, again, entirely possible. But you should be more concerned with how possible. Are they likely to have processes in place to stop this happening? Probably. Do you trust their reputation enough to ensure these processes are followed? That's for you to decide.
Security is a series of trade-offs and compromises. If you want to use their hardware and software, then you have to compromise on trust, just as you do when you trust your OS firewall or antivirus software to protect you.