ERC-20 defines a handful of functions every fungible token implements: balance lookups, transfers, and the approve-and-transferFrom pattern behind every token-approval. Standardisation is what made DeFi composable.
Two things the standard does not guarantee. First, it says nothing about the token being legitimate: anyone can deploy one with any name and symbol in minutes. Second, implementations may add behaviour, such as transfer taxes, blacklists or mint functions, on top of the interface.
Before trading any token, verify the contract address from an independent source, read whether the owner can mint or freeze, and check holder concentration. See honeypot-token and token-blacklist-function.
Related: token-approval, erc-721, honeypot-token, token-blacklist-function