Correct, though on second thought, given how slow many DAOs are to operate, the perpetrators would already be in some other uncontrollable currency by the time people voted to blacklist certain wallets.
Doing so would mean the token could be transacted, except by users who are on the blocklist and not on the allow-list. And this would prevent a privileged user from abusing the power to add accounts to the block-list. Getting unblocked at the speed of DAO is less of a concern, as long as blocked account-holders can still vote with their tokens.