Fiber uses the same security architecture as the enclave-based designed pioneered by Privy. Your key is shareded using SSS and split between multiple security boundaries, across multiple clouds. One key is stored encrypted by the API servers and one key is stored encrypted in a internet-less enclave.
In order to sign any transaction, the actions need to be explicitly authorized by the end user. Fiber is not able to move funds or initiate any action on behalf of the user that wasn’t previously authorized.