Yes, the exit relay can do any of the behaviors you describe. It can modify the data that comes back from the website (or whatever the destination is), or it can simply pretend to be the destination and send you whatever it wants to. It can also send other Tor cells, like padding cells, if it wants.
Applications like Firefox rely on end-to-end encryption (like https) to recognize if data has been tampered by a man in the middle. In this case the exit relay is indeed 'in the middle' between the browser and the webserver. End-to-end encryption is a good idea whether you are using Tor or not.
The other questions listed here as 'related' look like more detailed duplicates of this question, so be sure to check them out too (and maybe even merge this question with one of them).