Lets say I create a transaction at my watching-only wallet. Then I sign it on my offline wallet. That means I just "toggle something"/"add some data that says signed" when I'm signing my transaction at the offline wallet.

That is not how Bitcoin or digital signatures work. By your logic wallets (online or offline) wouldn't work in general. Private keys are not broadcast to the network or given to anyone unless the person who generated them (and thus owns them) does something.

Digital signatures work via mathematics to generate a proof. With a specific message and public key, only the person who controls the private key that corresponds to the public key is able to generate a valid proof. That proof is the signature, and that is what is added to a transaction. Signatures do not require the signing device to be online. Signing is an entirely offline operation that only does math, nothing else.

Even if I sign it at the online-wallet somebody could just change the sourcecode of the client that he does not need the private-key to sign something.

The signature validation operation is a consensus rule. Every must follow that exact rule otherwise you will be forked off of the network. Sure you can make a client that doesn't do that validation, but then you aren't using Bitcoin, and if no one uses your client and its forked blockchain (as that will happen), then your transaction and coins on that chain are completely worthless.