I'm developing a DApp project with React, Web3 and solidity to study and I saw that the functions of sending eth to another wallet, within the smart contract, receive a msg.sender, msg.value and a parameter with the address of the recipient. Below I leave my code that I have for now:

<Send.sol>

    pragma solidity ^0.8.10;

    contract Send {
        constructor() payable {}

        receive() external payable {}

        function sendViaCall(address payable _to) external payable {
            (bool success, ) = _to.call{value: msg.value}("");

            require(success, "Send failed");
        }
    }

    contract Receive {
        event Log(uint256 amount, uint256 gas);

        receive() external payable {
            emit Log(msg.value, gasleft());
        }
    }

<withETH.js> (A context for Web3)

    import { createContext, useState, useEffect } from "react";
import { SEND_ABI, SEND_ADDRESS } from "../configs/configContract";
import Web3 from "web3";

export const ETHContext = createContext({
  blockNr: null,
  accountId: null,
  send: () => null,
});

export const ETHProvider = ({ children }) => {
  const [blockNr, setBlockNr] = useState();
  const [accountId, setAccountId] = useState();
  const [contract, setContract] = useState();

  useEffect(() => {
    loadBlockchainData();
  }, []);

  const loadBlockchainData = async () => {
    const web3 = new Web3(Web3.givenProvider || "http://localhost:7545");

    const accounts = await web3.eth.getAccounts();
    setAccountId(accounts[0]);

    const blockNumber = await web3.eth.getBlockNumber();
    setBlockNr(blockNumber);

    const contract = new web3.eth.Contract(SEND_ABI, SEND_ADDRESS);
    setContract(contract);
  };

  const send = async (userId) => {
    const web3 = new Web3(Web3.givenProvider || "http://localhost:7545");

    await contract.methods.sendViaCall(userId).send({
      from: accountId,
      to: userId,
      value: web3.utils.toWei("2", "ether"),
    });
    loadBlockchainData();
  };

  return (
    <ETHContext.Provider
      value={{
        accountId,
        blockNr,
        send,
      }}
    >
      {children}
    </ETHContext.Provider>
  );
};

In the code snippet below, I call my contract template and pass the id of who will receive it, who is being sent (from), who will receive it (to "I imagine this parameter is unnecessary as I go through the parameter of the called function. Am I right?"), and the value (value). What guarantees me that someone will not change the value, the receiver id or their own id?

await contract.methods.sendViaCall(userId).send({
  from: accountId,
  to: userId,
  value: web3.utils.toWei("2", "ether"),
})