For example, if I go to
google.com can they send back
An exit node (no matter if Tor or VPN) has full control what data are sent and where they get sent to. This means it can modify the data from client to server, from server to client or send the data from the client to a different server. If you want to protect yourself against this then you should use end-to-end encryption and authentication, i.e. HTTPS.