How does L2 keep the security of Ethereum?

Explain like I'm 5 please.

If we add layers on top of the ETH PoW mechanism, how does that new layer adhere to the security and trust we have come to love about Ethereum? Same question for BTC. If we have to validate using a different layer can't it then be messed with once the actual ETH (or BTC) miners see the transaction?