Most deployed protocols are upgradeable, which means the code you audited today can be different tomorrow. Whoever controls the upgrade key can, in principle, replace the logic that holds your deposits with logic that does not.
The risk is not only malice. Keys get phished, laptops get compromised, and insiders get coerced. Several of the largest losses in the sector traced back to compromised signing keys rather than to any flaw in the contracts themselves.
What reduces it: a genuine multisig-wallet with independent signers rather than one person with several devices, a meaningful timelock on every privileged action, and eventually renouncing ownership where the design permits. Block explorers show current owners and roles, and checking them takes a minute.
Related: timelock, multisig-wallet, smart-contract-audit, token-blacklist-function