Custody During Liquidity Providing

Yes, the assets are transferred to THORChain’s/Mayachain's address/vaults on-chain but only your address (private key) can redeem the asset back. All code is open-sourced, and is audited multiple times. You can either audit the code yourself, or trust the community who have pored over the code; to make sure the above points are correct.